zgrat | 872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

Analysis

max time kernel
21s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan 1.16.5 Crack.exe
Size

8.7MB
MD5

57ec49d438753f3bdfec6a616258b370
SHA1

a34f757f5f2bd4763f04206c0d0cd32ab4491117
SHA256

872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638
SHA512

88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a
SSDEEP

196608:ITAJDpNk+Rl4/Xi/yRvyCyKuhBfldGdrmVLaY1rHgu:oAlzJ7yRvyCx+xpgu

Score

10^/10

zgrat rat upx

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000014702-43.dat	family_zgrat_v1
behavioral2/memory/5480-123-0x00000000011C0000-0x000000000154E000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0006000000015cbd-175.dat	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 64 IoCs

pid	Process
2224	Nursultan 1.16.5 Crack.exe
1300	Nursultan 1.16.5 Crack.exe
2172	leetcrack.exe
2608	leetcrack.exe
2724	Nursultan 1.16.5 Crack.exe
2760	leetcrack.exe
2876	Nursultan 1.16.5 Crack.exe
3000	3b73a6fa2092a350d795.exe
2796	leetcrack.exe
2680	portmonitor.exe
2528	Nursultan 1.16.5 Crack.exe
2744	Nursultan 1.16.5 Crack.exe
1956	Nursultan 1.16.5 Crack.exe
2840	Nursultan 1.16.5 Crack.exe
2932	Nursultan 1.16.5 Crack.exe
1904	Nursultan 1.16.5 Crack.exe
1676	Nursultan 1.16.5 Crack.exe
2232	leetcrack.exe
2632	leetcrack.exe
2764	leetcrack.exe
2836	leetcrack.exe
2532	leetcrack.exe
2176	leetcrack.exe
1732	leetcrack.exe
2096	Nursultan 1.16.5 Crack.exe
2552	leetcrack.exe
2704	Nursultan 1.16.5 Crack.exe
768	leetcrack.exe
772	Nursultan 1.16.5 Crack.exe
1444	leetcrack.exe
1208	Nursultan 1.16.5 Crack.exe
872	leetcrack.exe
2308	Nursultan 1.16.5 Crack.exe
2312	leetcrack.exe
2128	Nursultan 1.16.5 Crack.exe
2012	leetcrack.exe
2304	Nursultan 1.16.5 Crack.exe
2896	leetcrack.exe
2832	Nursultan 1.16.5 Crack.exe
2196	leetcrack.exe
2236	Nursultan 1.16.5 Crack.exe
2716	leetcrack.exe
592	leetcrack.exe
596	Nursultan 1.16.5 Crack.exe
764	leetcrack.exe
992	Nursultan 1.16.5 Crack.exe
1892	leetcrack.exe
3068	Nursultan 1.16.5 Crack.exe
1320	3b73a6fa2092a350d795.exe
704	portmonitor.exe
780	Nursultan 1.16.5 Crack.exe
2064	3b73a6fa2092a350d795.exe
2904	3b73a6fa2092a350d795.exe
1332	3b73a6fa2092a350d795.exe
940	3b73a6fa2092a350d795.exe
1280	3b73a6fa2092a350d795.exe
3020	3b73a6fa2092a350d795.exe
2076	3b73a6fa2092a350d795.exe
1836	3b73a6fa2092a350d795.exe
308	3b73a6fa2092a350d795.exe
1952	portmonitor.exe
3012	portmonitor.exe
1292	portmonitor.exe
1596	portmonitor.exe

Loads dropped DLL 64 IoCs

pid	Process
2388	Nursultan 1.16.5 Crack.exe
2224	Nursultan 1.16.5 Crack.exe
2224	Nursultan 1.16.5 Crack.exe
2388	Nursultan 1.16.5 Crack.exe
2224	Nursultan 1.16.5 Crack.exe
2388	Nursultan 1.16.5 Crack.exe
1300	Nursultan 1.16.5 Crack.exe
2724	Nursultan 1.16.5 Crack.exe
2724	Nursultan 1.16.5 Crack.exe
2724	Nursultan 1.16.5 Crack.exe
1300	Nursultan 1.16.5 Crack.exe
1300	Nursultan 1.16.5 Crack.exe
2172	leetcrack.exe
2172	leetcrack.exe
2876	Nursultan 1.16.5 Crack.exe
2876	Nursultan 1.16.5 Crack.exe
2876	Nursultan 1.16.5 Crack.exe
2528	Nursultan 1.16.5 Crack.exe
2528	Nursultan 1.16.5 Crack.exe
2528	Nursultan 1.16.5 Crack.exe
2744	Nursultan 1.16.5 Crack.exe
2744	Nursultan 1.16.5 Crack.exe
2744	Nursultan 1.16.5 Crack.exe
1956	Nursultan 1.16.5 Crack.exe
1956	Nursultan 1.16.5 Crack.exe
1956	Nursultan 1.16.5 Crack.exe
2840	Nursultan 1.16.5 Crack.exe
2840	Nursultan 1.16.5 Crack.exe
2840	Nursultan 1.16.5 Crack.exe
2932	Nursultan 1.16.5 Crack.exe
2932	Nursultan 1.16.5 Crack.exe
2932	Nursultan 1.16.5 Crack.exe
1904	Nursultan 1.16.5 Crack.exe
1904	Nursultan 1.16.5 Crack.exe
1904	Nursultan 1.16.5 Crack.exe
1676	Nursultan 1.16.5 Crack.exe
1676	Nursultan 1.16.5 Crack.exe
1676	Nursultan 1.16.5 Crack.exe
2096	Nursultan 1.16.5 Crack.exe
2096	Nursultan 1.16.5 Crack.exe
2096	Nursultan 1.16.5 Crack.exe
2704	Nursultan 1.16.5 Crack.exe
2704	Nursultan 1.16.5 Crack.exe
2704	Nursultan 1.16.5 Crack.exe
772	Nursultan 1.16.5 Crack.exe
772	Nursultan 1.16.5 Crack.exe
772	Nursultan 1.16.5 Crack.exe
1208	Nursultan 1.16.5 Crack.exe
1208	Nursultan 1.16.5 Crack.exe
1208	Nursultan 1.16.5 Crack.exe
2308	Nursultan 1.16.5 Crack.exe
2308	Nursultan 1.16.5 Crack.exe
2308	Nursultan 1.16.5 Crack.exe
2128	Nursultan 1.16.5 Crack.exe
2128	Nursultan 1.16.5 Crack.exe
2128	Nursultan 1.16.5 Crack.exe
2304	Nursultan 1.16.5 Crack.exe
2304	Nursultan 1.16.5 Crack.exe
2304	Nursultan 1.16.5 Crack.exe
2832	Nursultan 1.16.5 Crack.exe
2832	Nursultan 1.16.5 Crack.exe
2832	Nursultan 1.16.5 Crack.exe
2236	Nursultan 1.16.5 Crack.exe
2236	Nursultan 1.16.5 Crack.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0038000000014502-32.dat	upx
behavioral2/memory/2608-88-0x00000000035B0000-0x00000000041DA000-memory.dmp	upx
behavioral2/memory/3000-39-0x000000013FAA0000-0x00000001406CA000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\3b73a6fa2092a350d795.exe	portmonitor.exe
File created	C:\Program Files\Google\Chrome\5edc5a7018482e	portmonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6044	schtasks.exe
5932	schtasks.exe
6024	schtasks.exe
6056	schtasks.exe
6856	schtasks.exe
7812	schtasks.exe
4544	schtasks.exe
5368	schtasks.exe
6808	schtasks.exe
8056	schtasks.exe
4288	schtasks.exe
6244	schtasks.exe
6956	schtasks.exe
6372	schtasks.exe
2136	schtasks.exe
1340	schtasks.exe
5684	schtasks.exe
2044	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4044	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe
5480	portmonitor.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5480	portmonitor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2224	2388	Nursultan 1.16.5 Crack.exe	110
PID 2388 wrote to memory of 2224	2388	Nursultan 1.16.5 Crack.exe	110
PID 2388 wrote to memory of 2224	2388	Nursultan 1.16.5 Crack.exe	110
PID 2388 wrote to memory of 2224	2388	Nursultan 1.16.5 Crack.exe	110
PID 2224 wrote to memory of 1300	2224	Nursultan 1.16.5 Crack.exe	29
PID 2224 wrote to memory of 1300	2224	Nursultan 1.16.5 Crack.exe	29
PID 2224 wrote to memory of 1300	2224	Nursultan 1.16.5 Crack.exe	29
PID 2224 wrote to memory of 1300	2224	Nursultan 1.16.5 Crack.exe	29
PID 2224 wrote to memory of 2172	2224	Nursultan 1.16.5 Crack.exe	250
PID 2224 wrote to memory of 2172	2224	Nursultan 1.16.5 Crack.exe	250
PID 2224 wrote to memory of 2172	2224	Nursultan 1.16.5 Crack.exe	250
PID 2224 wrote to memory of 2172	2224	Nursultan 1.16.5 Crack.exe	250
PID 2388 wrote to memory of 2608	2388	Nursultan 1.16.5 Crack.exe	31
PID 2388 wrote to memory of 2608	2388	Nursultan 1.16.5 Crack.exe	31
PID 2388 wrote to memory of 2608	2388	Nursultan 1.16.5 Crack.exe	31
PID 2388 wrote to memory of 2608	2388	Nursultan 1.16.5 Crack.exe	31
PID 1300 wrote to memory of 2724	1300	Nursultan 1.16.5 Crack.exe	115
PID 1300 wrote to memory of 2724	1300	Nursultan 1.16.5 Crack.exe	115
PID 1300 wrote to memory of 2724	1300	Nursultan 1.16.5 Crack.exe	115
PID 1300 wrote to memory of 2724	1300	Nursultan 1.16.5 Crack.exe	115
PID 2724 wrote to memory of 2876	2724	Nursultan 1.16.5 Crack.exe	118
PID 2724 wrote to memory of 2876	2724	Nursultan 1.16.5 Crack.exe	118
PID 2724 wrote to memory of 2876	2724	Nursultan 1.16.5 Crack.exe	118
PID 2724 wrote to memory of 2876	2724	Nursultan 1.16.5 Crack.exe	118
PID 2724 wrote to memory of 2760	2724	Nursultan 1.16.5 Crack.exe	138
PID 2724 wrote to memory of 2760	2724	Nursultan 1.16.5 Crack.exe	138
PID 2724 wrote to memory of 2760	2724	Nursultan 1.16.5 Crack.exe	138
PID 2724 wrote to memory of 2760	2724	Nursultan 1.16.5 Crack.exe	138
PID 1300 wrote to memory of 2796	1300	Nursultan 1.16.5 Crack.exe	147
PID 1300 wrote to memory of 2796	1300	Nursultan 1.16.5 Crack.exe	147
PID 1300 wrote to memory of 2796	1300	Nursultan 1.16.5 Crack.exe	147
PID 1300 wrote to memory of 2796	1300	Nursultan 1.16.5 Crack.exe	147
PID 2172 wrote to memory of 3000	2172	leetcrack.exe	36
PID 2172 wrote to memory of 3000	2172	leetcrack.exe	36
PID 2172 wrote to memory of 3000	2172	leetcrack.exe	36
PID 2172 wrote to memory of 3000	2172	leetcrack.exe	36
PID 2172 wrote to memory of 2680	2172	leetcrack.exe	934
PID 2172 wrote to memory of 2680	2172	leetcrack.exe	934
PID 2172 wrote to memory of 2680	2172	leetcrack.exe	934
PID 2172 wrote to memory of 2680	2172	leetcrack.exe	934
PID 2876 wrote to memory of 2528	2876	Nursultan 1.16.5 Crack.exe	358
PID 2876 wrote to memory of 2528	2876	Nursultan 1.16.5 Crack.exe	358
PID 2876 wrote to memory of 2528	2876	Nursultan 1.16.5 Crack.exe	358
PID 2876 wrote to memory of 2528	2876	Nursultan 1.16.5 Crack.exe	358
PID 2876 wrote to memory of 2232	2876	Nursultan 1.16.5 Crack.exe	330
PID 2876 wrote to memory of 2232	2876	Nursultan 1.16.5 Crack.exe	330
PID 2876 wrote to memory of 2232	2876	Nursultan 1.16.5 Crack.exe	330
PID 2876 wrote to memory of 2232	2876	Nursultan 1.16.5 Crack.exe	330
PID 2528 wrote to memory of 2744	2528	Nursultan 1.16.5 Crack.exe	1063
PID 2528 wrote to memory of 2744	2528	Nursultan 1.16.5 Crack.exe	1063
PID 2528 wrote to memory of 2744	2528	Nursultan 1.16.5 Crack.exe	1063
PID 2528 wrote to memory of 2744	2528	Nursultan 1.16.5 Crack.exe	1063
PID 2528 wrote to memory of 2632	2528	Nursultan 1.16.5 Crack.exe	253
PID 2528 wrote to memory of 2632	2528	Nursultan 1.16.5 Crack.exe	253
PID 2528 wrote to memory of 2632	2528	Nursultan 1.16.5 Crack.exe	253
PID 2528 wrote to memory of 2632	2528	Nursultan 1.16.5 Crack.exe	253
PID 2744 wrote to memory of 1956	2744	Nursultan 1.16.5 Crack.exe	166
PID 2744 wrote to memory of 1956	2744	Nursultan 1.16.5 Crack.exe	166
PID 2744 wrote to memory of 1956	2744	Nursultan 1.16.5 Crack.exe	166
PID 2744 wrote to memory of 1956	2744	Nursultan 1.16.5 Crack.exe	166
PID 2744 wrote to memory of 2764	2744	Nursultan 1.16.5 Crack.exe	43
PID 2744 wrote to memory of 2764	2744	Nursultan 1.16.5 Crack.exe	43
PID 2744 wrote to memory of 2764	2744	Nursultan 1.16.5 Crack.exe	43
PID 2744 wrote to memory of 2764	2744	Nursultan 1.16.5 Crack.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        22⤵
        Executes dropped EXE
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        23⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        24⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        25⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        26⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        27⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        28⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        29⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        30⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        31⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        32⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        33⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        34⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        35⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        36⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        37⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        38⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        39⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        40⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        41⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        42⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        43⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        44⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        45⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        46⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        47⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        48⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        49⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        50⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        51⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        52⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        53⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        54⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        55⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        56⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        57⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        58⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        59⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        60⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        61⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        62⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        63⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        64⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        65⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        66⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        67⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        68⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        69⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        70⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        71⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        72⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        73⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        74⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        75⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        76⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        77⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        78⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        79⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        80⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        81⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        82⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        83⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        84⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        85⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        86⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        87⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        88⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        89⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        90⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        91⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        92⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        93⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        94⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        95⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        96⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        97⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        98⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        99⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        100⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        101⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        102⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        103⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        104⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        105⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        106⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        107⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        108⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        109⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        110⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        111⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        112⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        113⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        114⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        115⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        116⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        117⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        118⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        119⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        120⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        121⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        122⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        123⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        124⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        125⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        126⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        127⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        128⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        129⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        130⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        131⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        132⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        133⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        134⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        135⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        136⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        137⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        138⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        139⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        140⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        141⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        142⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        143⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        144⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        145⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        146⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        147⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        148⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        149⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        150⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        151⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        152⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        153⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        153⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        152⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        153⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        153⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        151⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        152⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        152⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        150⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        151⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        151⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        149⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        150⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        150⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        148⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        149⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        149⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        147⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        148⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        148⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        146⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        147⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        147⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        145⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        146⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        146⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        144⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        145⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        145⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        143⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        144⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        144⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        142⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        143⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        143⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        141⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        142⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        142⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        140⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        141⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        141⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        142⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        139⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        140⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        140⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        138⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        139⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        139⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        140⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        137⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        138⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        138⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        136⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        137⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        137⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        138⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        135⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        136⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        136⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        137⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        134⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        135⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        135⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        136⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        133⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        134⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        134⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        135⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        132⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        133⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        133⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        134⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        131⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        132⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        132⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        133⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        134⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        130⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        131⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        131⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        132⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        133⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        129⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        130⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        130⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        131⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        132⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        128⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        129⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        129⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        130⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        131⤵
        
        PID:6064
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        132⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        127⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        128⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        128⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        129⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        130⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        126⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        127⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        127⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        128⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        129⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        125⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        126⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        126⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        127⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        128⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        124⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        125⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        125⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        126⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        127⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        123⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        124⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        124⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        125⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        126⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        122⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        123⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        123⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        124⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        125⤵
        
        PID:4260
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        126⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        121⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        122⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        122⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        123⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        124⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        120⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        121⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        121⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        122⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        123⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        119⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        120⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        120⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        121⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        122⤵
        
        PID:5988
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        123⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        118⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        119⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        119⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        120⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        121⤵
        
        PID:6560
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        122⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        117⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        118⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        118⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        119⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        120⤵
        
        PID:2460
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        121⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        116⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        117⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        117⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        118⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        119⤵
        
        PID:3352
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        120⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        115⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        116⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        116⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        117⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        118⤵
        
        PID:6356
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        119⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        114⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        115⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        115⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        116⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        117⤵
        
        PID:3172
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        118⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        113⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        114⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        114⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        115⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        116⤵
        
        PID:2744
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        117⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        112⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        113⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        113⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        114⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        115⤵
        
        PID:7024
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        116⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        111⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        112⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        112⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        113⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        114⤵
        
        PID:3192
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        115⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        110⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        111⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        111⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        112⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        113⤵
        
        PID:3324
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        114⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        109⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        110⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        110⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        111⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        112⤵
        
        PID:6316
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        113⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        108⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        109⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        109⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        110⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        111⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        107⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        108⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        108⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        109⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        110⤵
        
        PID:5756
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        111⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        106⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        107⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        107⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        108⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        109⤵
        
        PID:3836
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        110⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        105⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        106⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        106⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        107⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        108⤵
        
        PID:5456
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        109⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        104⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        105⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        105⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        106⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        107⤵
        
        PID:2436
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        108⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        103⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        104⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        104⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        105⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        106⤵
        
        PID:6528
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        107⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        102⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        103⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        103⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        104⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        105⤵
        
        PID:4416
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        106⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        101⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        102⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        102⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        103⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        104⤵
        
        PID:4988
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        105⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        100⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        101⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        101⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        102⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        103⤵
        
        PID:1644
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        104⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        99⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        100⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        100⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        101⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        102⤵
        
        PID:4828
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        103⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        98⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        99⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        99⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        100⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        101⤵
        
        PID:5732
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        102⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        97⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        98⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        98⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        99⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        100⤵
        
        PID:4228
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        101⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        96⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        97⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        97⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        98⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        99⤵
        
        PID:1176
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        100⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        95⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        96⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        96⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        97⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        98⤵
        
        PID:2592
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        99⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        94⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        95⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        95⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        96⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        97⤵
        
        PID:5084
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        98⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        93⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        94⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        94⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        95⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        96⤵
        
        PID:4980
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        97⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        92⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        93⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        93⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        94⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        95⤵
        
        PID:4800
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        96⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        91⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        92⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        92⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        93⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        94⤵
        
        PID:5936
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        95⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        90⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        91⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        91⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        92⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        93⤵
        
        PID:4340
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        94⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        89⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        90⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        90⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        91⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        92⤵
        
        PID:7828
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        93⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        88⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        89⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        89⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        90⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        91⤵
        
        PID:3492
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        92⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        87⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        88⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        88⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        89⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        90⤵
        
        PID:3168
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        91⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        86⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        87⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        87⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        88⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        89⤵
        
        PID:1160
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        90⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        85⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        86⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        86⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        87⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        88⤵
        
        PID:6928
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        89⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        84⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        85⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        85⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        86⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        87⤵
        
        PID:7300
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        88⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        83⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        84⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        84⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        85⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        86⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        82⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        83⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        83⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        84⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        85⤵
        
        PID:7316
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        86⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        81⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        82⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        82⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        83⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        84⤵
        
        PID:6028
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        85⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        80⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        81⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        81⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        82⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        83⤵
        
        PID:6996
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        84⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        79⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        80⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        80⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        81⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        82⤵
        
        PID:6332
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        83⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        78⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        79⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        79⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        80⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        81⤵
        
        PID:6424
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        82⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        77⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        78⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        78⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        79⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        80⤵
        
        PID:3464
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        81⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        76⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        77⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        77⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        78⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        79⤵
        
        PID:3012
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        80⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        75⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        76⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        76⤵
        
        PID:476
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        77⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        78⤵
        
        PID:2512
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        79⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        74⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        75⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        75⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        76⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        77⤵
        
        PID:8036
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        78⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        73⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        74⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        74⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        75⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        76⤵
        
        PID:2680
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        77⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        72⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        73⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        73⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        74⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        75⤵
        
        PID:7768
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        76⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        71⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        72⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        72⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        73⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        74⤵
        
        PID:3144
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        75⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        70⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        71⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        71⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        72⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        73⤵
        
        PID:6952
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        74⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        69⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        70⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        70⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        71⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        72⤵
        
        PID:8040
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        73⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        68⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        69⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        69⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        70⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        71⤵
        
        PID:8124
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        72⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        67⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        68⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        68⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        69⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        70⤵
        
        PID:1672
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        71⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        66⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        67⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        67⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        68⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        69⤵
        
        PID:7932
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        70⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        65⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        66⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        66⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        67⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        68⤵
        
        PID:7924
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        69⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        64⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        65⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        65⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        66⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        67⤵
        
        PID:7868
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        68⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        63⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        64⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        64⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        65⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        66⤵
        
        PID:7804
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        67⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        62⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        63⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        63⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        64⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        65⤵
        
        PID:7728
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        66⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        61⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        62⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        62⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        63⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        64⤵
        
        PID:7684
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        65⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        60⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        61⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        61⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        62⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        63⤵
        
        PID:7576
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        64⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        59⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        60⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        60⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        61⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        62⤵
        
        PID:7532
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        63⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        58⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        59⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        59⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        60⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        61⤵
        
        PID:7720
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        62⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        57⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        58⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        58⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        59⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        60⤵
        
        PID:7540
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        61⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        56⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        57⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        57⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        58⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        59⤵
        
        PID:7616
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        60⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        55⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        56⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        56⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        57⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        58⤵
        
        PID:7560
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        59⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        54⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        55⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        55⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        56⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        57⤵
        
        PID:7484
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        58⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        53⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        54⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        54⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        55⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        56⤵
        
        PID:7412
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        57⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        52⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        53⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        53⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        54⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        55⤵
        
        PID:7404
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        56⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        51⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        52⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        52⤵
        
        PID:604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        53⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        54⤵
        
        PID:7388
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        55⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        50⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        51⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        51⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        52⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        53⤵
        
        PID:7356
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        54⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        49⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        50⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        50⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        51⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        52⤵
        
        PID:7204
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        53⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        48⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        49⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        49⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        50⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        51⤵
        
        PID:840
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        52⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        47⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        48⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        48⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        49⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        50⤵
        
        PID:7176
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        51⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        46⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        47⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        47⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        48⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        49⤵
        
        PID:7188
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        50⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        45⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        46⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        46⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        47⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        48⤵
        
        PID:2776
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        49⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        44⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        45⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        45⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        46⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        47⤵
        
        PID:2648
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        48⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        43⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        44⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        44⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        45⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        46⤵
        
        PID:6484
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        47⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        42⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        43⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        43⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        44⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        45⤵
        
        PID:3768
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        46⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        41⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        42⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        42⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        43⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        44⤵
        
        PID:1976
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        45⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        40⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        41⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        41⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        42⤵
        
        PID:536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        43⤵
        
        PID:3460
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        44⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        39⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        40⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        40⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        41⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        42⤵
        
        PID:2792
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        43⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        38⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        39⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        39⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        40⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        41⤵
        
        PID:3440
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        42⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        37⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        38⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        38⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        39⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        40⤵
        
        PID:3348
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        41⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        36⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        37⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        37⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        38⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        39⤵
        
        PID:2716
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        40⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        35⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        36⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        36⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        37⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        38⤵
        
        PID:2672
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        39⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        34⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        35⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        35⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        36⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        37⤵
        
        PID:5724
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        38⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        33⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        34⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        34⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        35⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        36⤵
        
        PID:7028
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        37⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        32⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        33⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        33⤵
        
        PID:872
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        34⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        35⤵
        
        PID:6376
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        36⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        31⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        32⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        32⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        33⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        34⤵
        
        PID:6156
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        35⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        30⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        31⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        31⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        32⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        33⤵
        
        PID:6032
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        34⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        29⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        30⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        30⤵
        
        PID:648
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        31⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        32⤵
        
        PID:7076
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        33⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        28⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        29⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        29⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        30⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        31⤵
        
        PID:6192
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        32⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        27⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        28⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        28⤵
        
        PID:924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        29⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        30⤵
        
        PID:2068
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        31⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        26⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        27⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        27⤵
        
        PID:772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        28⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        29⤵
        
        PID:6588
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        30⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        25⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        26⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        26⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        27⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        28⤵
        
        PID:1568
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        29⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        24⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        25⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        25⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        26⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        27⤵
        
        PID:5220
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        28⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        23⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        24⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        24⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        25⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        26⤵
        
        PID:1832
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        27⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        22⤵
        Executes dropped EXE
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        23⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        23⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        24⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        25⤵
        
        PID:6628
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        26⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        21⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        22⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        22⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        23⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        24⤵
        
        PID:6224
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        25⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        20⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        21⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        21⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        22⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        23⤵
        
        PID:6808
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        24⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        19⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        20⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        20⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        21⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        22⤵
        
        PID:6824
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        23⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        18⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        19⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        19⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        20⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        21⤵
        
        PID:6648
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        22⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        17⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        18⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        18⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        19⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        20⤵
        
        PID:7000
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        21⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        16⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        17⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        17⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        18⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        19⤵
        
        PID:3068
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        20⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        15⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        16⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        16⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        17⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        18⤵
        
        PID:6548
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        19⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        14⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        15⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        15⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        16⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        17⤵
        
        PID:2052
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        18⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        13⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        14⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        14⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        15⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        16⤵
        
        PID:1740
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        17⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        12⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        13⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        13⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        14⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        15⤵
        
        PID:5260
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        16⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        11⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        12⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        12⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        13⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        14⤵
        
        PID:2856
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        15⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        10⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        11⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        11⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        12⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        13⤵
        
        PID:5436
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        14⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        9⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        10⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        10⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        11⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        12⤵
        
        PID:1456
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        13⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        8⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        9⤵
        Executes dropped EXE
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        9⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        10⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        11⤵
        
        PID:5532
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        12⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        7⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        8⤵
        Executes dropped EXE
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        9⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        10⤵
        
        PID:5960
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        11⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        6⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        7⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        8⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        9⤵
        
        PID:4192
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        10⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        5⤵
        Executes dropped EXE
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        6⤵
        Executes dropped EXE
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        6⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        7⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        8⤵
        
        PID:6608
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        9⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
      "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
      4⤵
      Executes dropped EXE
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        5⤵
        Executes dropped EXE
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        5⤵
        
        PID:348
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        6⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        7⤵
        
        PID:6540
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        8⤵
        
        PID:7044
- - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
    "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
      "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
      4⤵
      Executes dropped EXE
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
      "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
      4⤵
      Executes dropped EXE
      PID:2680
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        5⤵
        
        PID:1812
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        6⤵
        
        PID:5136
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        7⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5480
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vwtpi1ty\vwtpi1ty.cmdline"
        8⤵
        
        PID:5256
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64BC.tmp" "c:\Windows\System32\CSC841C27668E3E424797C4D76114389C5F.TMP"
        9⤵
        
        PID:5564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Wd1cHapA1.bat"
        8⤵
        
        PID:5948
- C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
  "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
    "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
    3⤵
    - Executes dropped EXE
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
    "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
    3⤵
    - Executes dropped EXE
    PID:704
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
      4⤵
      PID:1416
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        5⤵
        
        PID:6028
      - C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        6⤵
        
        PID:5380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Webnet\Idle.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Webnet\Idle.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Webnet\Idle.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\3b73a6fa2092a350d795.exe'" /f
1⤵
- Creates scheduled task(s)
PID:6056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1392685683-1431480079-16313789591545432858-6970500671955770303291368500733933889"
1⤵
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:6024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 7 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\portmonitor.exe'" /f
1⤵
- Creates scheduled task(s)
PID:5684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitor" /sc ONLOGON /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\portmonitor.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:6244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 12 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\portmonitor.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:6372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\3b73a6fa2092a350d795.exe'" /f
1⤵
- Creates scheduled task(s)
PID:6808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:6956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1276781790843405754824193998186306868276401445-209735369113277649821586318089"
1⤵
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Desktop\3b73a6fa2092a350d795.exe'" /f
1⤵
- Creates scheduled task(s)
PID:6856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "107188286811041997831635987438112550777612921289381175777053-10392559721816586436"
1⤵
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Desktop\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:7812

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1042863691351996513-1715508267-367597271-154616118-1541261910-1856470298921063948"
1⤵
PID:2516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1640609158-17723843441756520951545210711-1210088530285444084-336064306-801344998"
1⤵
PID:3376

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-5120319011626704094817760125265703056-1411473317-1751547240952513273-1758037024"
1⤵
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 10 /tr "'C:\Webnet\portmonitor.exe'" /f
1⤵
- Creates scheduled task(s)
PID:8056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9295262161585932785-2004673464-14108943069706236221174909536-1260646181584755083"
1⤵
PID:5340

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "38041082144056391-11841734851982116950-968272075777734152-7933467942146393757"
1⤵
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitor" /sc ONLOGON /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2028720399-17066922901760029033-860990315-6182371251276744764140680668-1893771388"
1⤵
PID:1580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "15215868311622639033-1926742951551844745-1505688411-1151944844-227108389-218685174"
1⤵
PID:2392

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-4895872851676314499-11423214132108211097-1084787797-16077787472054827797-1945148410"
1⤵
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 14 /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\portmonitor.exe

Filesize
3.5MB

MD5
aa6c98cd853bf585a410394fd10817dc

SHA1
ceab1865997ae2c6e070a9c6adf6b129cf2ad383

SHA256
fc45eebea5ae88160a2ac49fe7e027baeee028c4f4b021794726a04ecea8c90b

SHA512
2ada05425dce38fd9fe48c9ceb6a21c59c5e7088274c4445dfde054974f14f8feba5012909c5a75d7932a6bcbb488e38d34d9c970cd61c636ee13abc59e06562

Download Submit
C:\Users\Admin\AppData\Local\Temp\leetcrack.exe

Filesize
8.7MB

MD5
93144ffd83e528ff8651605be2d2c1a4

SHA1
6c661ce690ecd3ecd21c8953e410543fcf8a69ad

SHA256
4ded33a5b292e88739e50c25c4db2ec8a4b444b21431f3daba87a2573965bd60

SHA512
5236edcac0e56126c0f83eccc930a96548788694e1505ee0f74e77ed41582b1c92573de2fef0bf1e69fa3e9bc355f45f4671a67da66612e1a24b8eb849ea668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\leetcrack.exe

Filesize
7.6MB

MD5
c385e52b1f0f3de52b70c9d8acf929bd

SHA1
f42de4bb47712e29beed9aad7109c7dad600c6d2

SHA256
b70a8eccf12c587ac0b15a55e0aed001f170b7ef464a0414ddef1c7747ce03a1

SHA512
fc471bb310c0906af508dc41e4c19c3ba1c13fe474313d9718c49d5f7a90b6e4b97bc5790cb74b98f1f9d09bd63cda22de778578cec273184c4df6464a73f6fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\portmonitor.exe

Filesize
3.8MB

MD5
3d686dda8f890bef092779bc682dec10

SHA1
2e6f12de7a5d4febe798a63b2f8914458741bf7f

SHA256
af9b7828f0661720eeaac5931f160f7db17dbf6c1ddcd7020a0c06a4deb2b7d4

SHA512
cb32222a74d01de5c99e5096e1e00f86ab54af0db9e6b560b5952de2ab1c654ebde7331e80302dedb387acc7ad7c98eae3748cf3bf2bb78c1d0a5088db881f58

Download Submit
\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe

Filesize
5.2MB

MD5
b86bbb42b26e72a601087f68cda89208

SHA1
baca49e35da3b83cd56ba579d61f98e9b137debe

SHA256
320eff01b2a5b520853cd9b0c7486b3d9992dce2f9308f267069a60f88f8deb0

SHA512
e98dfeb55d6053d6e2ec323f4665b4ea8cdb5bae0807ac70ac5dbb6cf7f3e8e1ba6a2ad099f8232b0e0ca9a738a9baf7d132957fb5d503c78283b229e35ed974

Download Submit
\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe

Filesize
8.7MB

MD5
57ec49d438753f3bdfec6a616258b370

SHA1
a34f757f5f2bd4763f04206c0d0cd32ab4491117

SHA256
872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

SHA512
88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a

Download Submit
\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe

Filesize
8.1MB

MD5
096b8b08d7d9a73f969a34533ce74591

SHA1
fc91d287439a0ddad18b91f15cf88587d7a9b518

SHA256
a91e446d71486c3c6ed939281976e9d6d22365ad5536634038702762f3da4aa5

SHA512
100a8839917acc2ba0ffd91aac9aa6c1369c7f99846f3dfe72233ab58734e3739e8d40927708d5c7214bb9dcf9a7436f1059885e5c99309d80cdf27768f1acf7

Download Submit
\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe

Filesize
5.2MB

MD5
ef9838ae0b18f9327e5dcf3b1e48f238

SHA1
e68c73f046936b54bb7483ac101aef166475d9a0

SHA256
aa10b0035d613e864cb9ae1b8a3fd7a56c2451f44595d458f05b794a048a81fc

SHA512
32ef1937bd584fe5dd8517b5a5345265c13c6c53f5d5d83d4ee1500e3cb0bf494aa4e1ed990756e33f482d08dbf1f4c256cdd6d65c5b787ffe8d973a66c65407

Download Submit
\Users\Admin\AppData\Local\Temp\leetcrack.exe

Filesize
7.1MB

MD5
196d18378f0500a85d89d1bdb2b419fa

SHA1
ef572c5b7e151ef8fd428826a4254cff959cc308

SHA256
b306e27f41d2fdf7014a9109151da53f37d638133ba57357bae8f20ad005fc32

SHA512
1fa4de00420ae7c971393d420e765c476f70bed5632a24fce0028ec192b546e4cc2a526043897e1866f72ba1361b93dc2aeaf86e22c20f977c07be39bb555f93

Download Submit
\Users\Admin\AppData\Local\Temp\leetcrack.exe

Filesize
7.6MB

MD5
bde15a6c9b63516e5037a70b6d456273

SHA1
28e449c935aa482a987131aa3a02f50133b1554b

SHA256
6e64c9544fd030d9824afe455705fe7c8948f08016873fcadc80cd202ba676fd

SHA512
b35616c925b7cee758047f18e8d551ee384aa17e9b73f51975828f825ea5f9763f13f2e3706e64a05d0a79b09256a661194c3935667a462ee216f90493793672

Download Submit
memory/1732-90-0x0000000003530000-0x000000000415A000-memory.dmp

Filesize
12.2MB

Download
memory/1732-236-0x0000000003530000-0x000000000415A000-memory.dmp

Filesize
12.2MB

Download
memory/2172-38-0x0000000003280000-0x0000000003EAA000-memory.dmp

Filesize
12.2MB

Download
memory/2608-88-0x00000000035B0000-0x00000000041DA000-memory.dmp

Filesize
12.2MB

Download
memory/2796-89-0x0000000003510000-0x000000000413A000-memory.dmp

Filesize
12.2MB

Download
memory/3000-39-0x000000013FAA0000-0x00000001406CA000-memory.dmp

Filesize
12.2MB

Download
memory/5480-143-0x0000000000E50000-0x0000000000E60000-memory.dmp

Filesize
64KB

Download
memory/5480-165-0x00000000010E0000-0x00000000010F8000-memory.dmp

Filesize
96KB

Download
memory/5480-137-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Filesize
64KB

Download
memory/5480-147-0x0000000000FF0000-0x0000000001002000-memory.dmp

Filesize
72KB

Download
memory/5480-149-0x0000000000E60000-0x0000000000E6E000-memory.dmp

Filesize
56KB

Download
memory/5480-155-0x000000001ACD0000-0x000000001AD2A000-memory.dmp

Filesize
360KB

Download
memory/5480-157-0x0000000001010000-0x000000000101E000-memory.dmp

Filesize
56KB

Download
memory/5480-169-0x000000001B960000-0x000000001B9AE000-memory.dmp

Filesize
312KB

Download
memory/5480-167-0x00000000010C0000-0x00000000010CC000-memory.dmp

Filesize
48KB

Download
memory/5480-127-0x0000000000600000-0x000000000060E000-memory.dmp

Filesize
56KB

Download
memory/5480-123-0x00000000011C0000-0x000000000154E000-memory.dmp

Filesize
3.6MB

Download
memory/5480-141-0x0000000000F90000-0x0000000000FA2000-memory.dmp

Filesize
72KB

Download
memory/5480-163-0x00000000010B0000-0x00000000010BE000-memory.dmp

Filesize
56KB

Download
memory/5480-161-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/5480-153-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Filesize
64KB

Download
memory/5480-151-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/5480-145-0x0000000000FD0000-0x0000000000FE6000-memory.dmp

Filesize
88KB

Download
memory/5480-139-0x0000000000E40000-0x0000000000E4E000-memory.dmp

Filesize
56KB

Download
memory/5480-135-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/5480-133-0x0000000000F70000-0x0000000000F88000-memory.dmp

Filesize
96KB

Download
memory/5480-131-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/5480-129-0x0000000000D20000-0x0000000000D3C000-memory.dmp

Filesize
112KB

Download
memory/5480-125-0x0000000000BE0000-0x0000000000C06000-memory.dmp

Filesize
152KB

Download