zgrat | 872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

Analysis

max time kernel
8s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07-05-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan 1.16.5 Crack.exe
Size

8.7MB
MD5

57ec49d438753f3bdfec6a616258b370
SHA1

a34f757f5f2bd4763f04206c0d0cd32ab4491117
SHA256

872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638
SHA512

88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a
SSDEEP

196608:ITAJDpNk+Rl4/Xi/yRvyCyKuhBfldGdrmVLaY1rHgu:oAlzJ7yRvyCx+xpgu

Score

10^/10

zgrat rat upx

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral3/files/0x000800000001ac4e-20.dat	family_zgrat_v1
behavioral3/memory/6040-271-0x00000000009B0000-0x0000000000D3E000-memory.dmp	family_zgrat_v1
behavioral3/files/0x000700000001ac55-329.dat	family_zgrat_v1

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8132	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7092	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6868	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7292	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8292	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8412	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8684	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8796	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8948	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9052	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7048	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8136	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7464	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7292	7912	schtasks.exe	495
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	7912	schtasks.exe	495

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 64 IoCs

pid	Process
2808	Nursultan 1.16.5 Crack.exe
4264	Nursultan 1.16.5 Crack.exe
4300	leetcrack.exe
240	leetcrack.exe
4500	Nursultan 1.16.5 Crack.exe
236	leetcrack.exe
1804	3b73a6fa2092a350d795.exe
2204	portmonitor.exe
4796	Nursultan 1.16.5 Crack.exe
4724	3b73a6fa2092a350d795.exe
344	portmonitor.exe
1780	portmonitor.exe
2912	3b73a6fa2092a350d795.exe
5056	leetcrack.exe
3164	Nursultan 1.16.5 Crack.exe
1800	leetcrack.exe
3916	3b73a6fa2092a350d795.exe
1264	portmonitor.exe
4620	Nursultan 1.16.5 Crack.exe
4196	3b73a6fa2092a350d795.exe
1768	leetcrack.exe
1048	portmonitor.exe
824	Nursultan 1.16.5 Crack.exe
4516	3b73a6fa2092a350d795.exe
1456	portmonitor.exe
1432	leetcrack.exe
3344	Nursultan 1.16.5 Crack.exe
5032	leetcrack.exe
2568	3b73a6fa2092a350d795.exe
804	portmonitor.exe
1708	Nursultan 1.16.5 Crack.exe
4116	3b73a6fa2092a350d795.exe
4696	leetcrack.exe
1992	portmonitor.exe
2904	Nursultan 1.16.5 Crack.exe
212	3b73a6fa2092a350d795.exe
4204	portmonitor.exe
200	leetcrack.exe
4072	Nursultan 1.16.5 Crack.exe
4636	leetcrack.exe
4188	3b73a6fa2092a350d795.exe
5056	portmonitor.exe
4576	Nursultan 1.16.5 Crack.exe
4608	3b73a6fa2092a350d795.exe
1780	portmonitor.exe
2576	leetcrack.exe
1360	Nursultan 1.16.5 Crack.exe
752	leetcrack.exe
1888	3b73a6fa2092a350d795.exe
2032	Nursultan 1.16.5 Crack.exe
4268	leetcrack.exe
1692	portmonitor.exe
4424	3b73a6fa2092a350d795.exe
1968	portmonitor.exe
4420	Nursultan 1.16.5 Crack.exe
804	3b73a6fa2092a350d795.exe
4704	portmonitor.exe
4668	leetcrack.exe
3824	Nursultan 1.16.5 Crack.exe
5116	leetcrack.exe
3640	3b73a6fa2092a350d795.exe
4480	portmonitor.exe
4204	Nursultan 1.16.5 Crack.exe
4416	leetcrack.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000800000001ac4b-9.dat	upx
behavioral3/memory/1804-29-0x00007FF62EAB0000-0x00007FF62F6DA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6868	schtasks.exe
2276	schtasks.exe
7292	schtasks.exe
8412	schtasks.exe
7092	schtasks.exe
8948	schtasks.exe
9052	schtasks.exe
3840	schtasks.exe
4876	schtasks.exe
8132	schtasks.exe
7464	schtasks.exe
8136	schtasks.exe
7292	schtasks.exe
3664	schtasks.exe
8292	schtasks.exe
8684	schtasks.exe
8796	schtasks.exe
7048	schtasks.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	portmonitor.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7512	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2808	3336	Nursultan 1.16.5 Crack.exe	196
PID 3336 wrote to memory of 2808	3336	Nursultan 1.16.5 Crack.exe	196
PID 3336 wrote to memory of 2808	3336	Nursultan 1.16.5 Crack.exe	196
PID 2808 wrote to memory of 4264	2808	Nursultan 1.16.5 Crack.exe	895
PID 2808 wrote to memory of 4264	2808	Nursultan 1.16.5 Crack.exe	895
PID 2808 wrote to memory of 4264	2808	Nursultan 1.16.5 Crack.exe	895
PID 3336 wrote to memory of 4300	3336	Nursultan 1.16.5 Crack.exe	75
PID 3336 wrote to memory of 4300	3336	Nursultan 1.16.5 Crack.exe	75
PID 3336 wrote to memory of 4300	3336	Nursultan 1.16.5 Crack.exe	75
PID 2808 wrote to memory of 240	2808	Nursultan 1.16.5 Crack.exe	76
PID 2808 wrote to memory of 240	2808	Nursultan 1.16.5 Crack.exe	76
PID 2808 wrote to memory of 240	2808	Nursultan 1.16.5 Crack.exe	76
PID 4264 wrote to memory of 4500	4264	Nursultan 1.16.5 Crack.exe	172
PID 4264 wrote to memory of 4500	4264	Nursultan 1.16.5 Crack.exe	172
PID 4264 wrote to memory of 4500	4264	Nursultan 1.16.5 Crack.exe	172
PID 4264 wrote to memory of 236	4264	Nursultan 1.16.5 Crack.exe	78
PID 4264 wrote to memory of 236	4264	Nursultan 1.16.5 Crack.exe	78
PID 4264 wrote to memory of 236	4264	Nursultan 1.16.5 Crack.exe	78
PID 4300 wrote to memory of 1804	4300	leetcrack.exe	79
PID 4300 wrote to memory of 1804	4300	leetcrack.exe	79
PID 4300 wrote to memory of 2204	4300	leetcrack.exe	547
PID 4300 wrote to memory of 2204	4300	leetcrack.exe	547
PID 4300 wrote to memory of 2204	4300	leetcrack.exe	547
PID 4500 wrote to memory of 4796	4500	Nursultan 1.16.5 Crack.exe	81
PID 4500 wrote to memory of 4796	4500	Nursultan 1.16.5 Crack.exe	81
PID 4500 wrote to memory of 4796	4500	Nursultan 1.16.5 Crack.exe	81
PID 240 wrote to memory of 4724	240	leetcrack.exe	82
PID 240 wrote to memory of 4724	240	leetcrack.exe	82
PID 240 wrote to memory of 344	240	leetcrack.exe	1002
PID 240 wrote to memory of 344	240	leetcrack.exe	1002
PID 240 wrote to memory of 344	240	leetcrack.exe	1002
PID 236 wrote to memory of 2912	236	leetcrack.exe	84
PID 236 wrote to memory of 2912	236	leetcrack.exe	84
PID 236 wrote to memory of 1780	236	leetcrack.exe	126
PID 236 wrote to memory of 1780	236	leetcrack.exe	126
PID 236 wrote to memory of 1780	236	leetcrack.exe	126
PID 4500 wrote to memory of 5056	4500	Nursultan 1.16.5 Crack.exe	901
PID 4500 wrote to memory of 5056	4500	Nursultan 1.16.5 Crack.exe	901
PID 4500 wrote to memory of 5056	4500	Nursultan 1.16.5 Crack.exe	901
PID 4796 wrote to memory of 3164	4796	Nursultan 1.16.5 Crack.exe	217
PID 4796 wrote to memory of 3164	4796	Nursultan 1.16.5 Crack.exe	217
PID 4796 wrote to memory of 3164	4796	Nursultan 1.16.5 Crack.exe	217
PID 4796 wrote to memory of 1800	4796	Nursultan 1.16.5 Crack.exe	824
PID 4796 wrote to memory of 1800	4796	Nursultan 1.16.5 Crack.exe	824
PID 4796 wrote to memory of 1800	4796	Nursultan 1.16.5 Crack.exe	824
PID 5056 wrote to memory of 3916	5056	leetcrack.exe	89
PID 5056 wrote to memory of 3916	5056	leetcrack.exe	89
PID 344 wrote to memory of 4804	344	portmonitor.exe	90
PID 344 wrote to memory of 4804	344	portmonitor.exe	90
PID 344 wrote to memory of 4804	344	portmonitor.exe	90
PID 2204 wrote to memory of 2340	2204	portmonitor.exe	91
PID 2204 wrote to memory of 2340	2204	portmonitor.exe	91
PID 2204 wrote to memory of 2340	2204	portmonitor.exe	91
PID 5056 wrote to memory of 1264	5056	leetcrack.exe	670
PID 5056 wrote to memory of 1264	5056	leetcrack.exe	670
PID 5056 wrote to memory of 1264	5056	leetcrack.exe	670
PID 1780 wrote to memory of 1580	1780	portmonitor.exe	1304
PID 1780 wrote to memory of 1580	1780	portmonitor.exe	1304
PID 1780 wrote to memory of 1580	1780	portmonitor.exe	1304
PID 3164 wrote to memory of 4620	3164	Nursultan 1.16.5 Crack.exe	785
PID 3164 wrote to memory of 4620	3164	Nursultan 1.16.5 Crack.exe	785
PID 3164 wrote to memory of 4620	3164	Nursultan 1.16.5 Crack.exe	785
PID 1800 wrote to memory of 4196	1800	leetcrack.exe	95
PID 1800 wrote to memory of 4196	1800	leetcrack.exe	95

C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        7⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        8⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        9⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        10⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        11⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        12⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        13⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        14⤵
        Executes dropped EXE
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        15⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        16⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        17⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        18⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        19⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        20⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        21⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        22⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        23⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        24⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        25⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        26⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        27⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        28⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        29⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        30⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        31⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        32⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        33⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        34⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        35⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        36⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        37⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        38⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        39⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        40⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        41⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        42⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        43⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        44⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        45⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        46⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        47⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        48⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        49⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        50⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        51⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        52⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        53⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        54⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        55⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        56⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        57⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        58⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        59⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        60⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        61⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        62⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        63⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        64⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        65⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        66⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        67⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        68⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        69⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        70⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        71⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        72⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        73⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        74⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        75⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        76⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        77⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        78⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        79⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        80⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        81⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        82⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        83⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        84⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        85⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        86⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        87⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        88⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        89⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        90⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        91⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        92⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        93⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        94⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        95⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        96⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        97⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        98⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        99⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        100⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        101⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        102⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        103⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        104⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        105⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        106⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        107⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        108⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        109⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        110⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        111⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        112⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        113⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        114⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        115⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        116⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        117⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        118⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        119⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        120⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        121⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        122⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        123⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        124⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        125⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        126⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        127⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        128⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        129⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        130⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        131⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        132⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        133⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        134⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        135⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        136⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        137⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        138⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        139⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        140⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        141⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        142⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        143⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        144⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        145⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        146⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        147⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        148⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        149⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        150⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        151⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        152⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        153⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        154⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        155⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        156⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        157⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        158⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        159⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        160⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        161⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        162⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        163⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        162⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        161⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        162⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        162⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        160⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        161⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        161⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        162⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        159⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        160⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        160⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        161⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        158⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        159⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        159⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        160⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        157⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        158⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        158⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        159⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        156⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        157⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        157⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        158⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        155⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        156⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        156⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        157⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        154⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        155⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        155⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        156⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        153⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        154⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        154⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        155⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        152⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        153⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        153⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        154⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        151⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        152⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        152⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        153⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        150⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        151⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        151⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        152⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        149⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        150⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        150⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        151⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        148⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        149⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        149⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        150⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        147⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        148⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        148⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        149⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        146⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        147⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        147⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        148⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        145⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        146⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        146⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        147⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        144⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        145⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        145⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        146⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        143⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        144⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        144⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        145⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        142⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        143⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        143⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        144⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        141⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        142⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        142⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        143⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        140⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        141⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        141⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        142⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        139⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        140⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        140⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        141⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        138⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        139⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        139⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        140⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        137⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        138⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        138⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        139⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        136⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        137⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        137⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        138⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        135⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        136⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        136⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        137⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        134⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        135⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        135⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        136⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        133⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        134⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        134⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        135⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        132⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        133⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        133⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        134⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        131⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        132⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        132⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        133⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        130⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        131⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        131⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        132⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        129⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        130⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        130⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        131⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        128⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        129⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        129⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        130⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        127⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        128⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        128⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        129⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        126⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        127⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        127⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        128⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        125⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        126⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        126⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        127⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        124⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        125⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        125⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        126⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        123⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        124⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        124⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        125⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        122⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        123⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        123⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        124⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        121⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        122⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        122⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        123⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        120⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        121⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        121⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        122⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        119⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        120⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        120⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        121⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        118⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        119⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        119⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        120⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        117⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        118⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        118⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        119⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        116⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        117⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        117⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        118⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        115⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        116⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        116⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        117⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        114⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        115⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        115⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        116⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        113⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        114⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        114⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        115⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        112⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        113⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        113⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        114⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        111⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        112⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        112⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        113⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        110⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        111⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        111⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        112⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        109⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        110⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        110⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        111⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        108⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        109⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        109⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        110⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        107⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        108⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        108⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        109⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        106⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        107⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        107⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        108⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        105⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        106⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        106⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        107⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        104⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        105⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        105⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        106⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        103⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        104⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        104⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        105⤵
        
        PID:164
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        102⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        103⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        103⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        104⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        101⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        102⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        102⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        103⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        100⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        101⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        101⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        102⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        99⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        100⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        100⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        101⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        102⤵
        
        PID:7612
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        103⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        98⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        99⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        99⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        100⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        101⤵
        
        PID:9176
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        102⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        97⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        98⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        98⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        99⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        100⤵
        
        PID:9980
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        101⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        96⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        97⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        97⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        98⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        99⤵
        
        PID:9504
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        100⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        95⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        96⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        96⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        97⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        98⤵
        
        PID:10200
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        99⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        94⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        95⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        95⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        96⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        97⤵
        
        PID:9928
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        98⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        93⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        94⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        94⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        95⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        96⤵
        
        PID:9332
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        97⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        92⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        93⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        93⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        94⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        95⤵
        
        PID:2160
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        96⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        91⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        92⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        92⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        93⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        94⤵
        
        PID:9924
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        95⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        90⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        91⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        91⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        92⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        93⤵
        
        PID:6624
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        94⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        89⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        90⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        90⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        91⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        92⤵
        
        PID:9808
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        93⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        88⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        89⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        89⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        90⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        91⤵
        
        PID:4880
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        92⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        87⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        88⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        88⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        89⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        90⤵
        
        PID:6872
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        91⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        86⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        87⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        87⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        88⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        89⤵
        
        PID:4184
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        90⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        85⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        86⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        86⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        87⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        88⤵
        
        PID:6880
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        89⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        84⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        85⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        85⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        86⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        87⤵
        
        PID:8900
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        88⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        83⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        84⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        84⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        85⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        86⤵
        
        PID:7064
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        87⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        82⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        83⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        83⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        84⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        85⤵
        
        PID:1792
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        86⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        81⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        82⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        82⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        83⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        84⤵
        
        PID:2336
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        85⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        80⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        81⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        81⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        82⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        83⤵
        
        PID:8568
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        84⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        79⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        80⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        80⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        81⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        82⤵
        
        PID:8328
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        83⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        78⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        79⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        79⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        80⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        81⤵
        
        PID:8324
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        82⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        77⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        78⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        78⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        79⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        80⤵
        
        PID:1800
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        81⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        76⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        77⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        77⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        78⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        79⤵
        
        PID:7616
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        80⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        75⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        76⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        76⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        77⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        78⤵
        
        PID:9896
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        79⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        74⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        75⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        75⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        76⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        77⤵
        
        PID:10016
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        78⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        73⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        74⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        74⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        75⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        76⤵
        
        PID:8924
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        77⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        72⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        73⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        73⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        74⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        75⤵
        
        PID:8136
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        76⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        71⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        72⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        72⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        73⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        74⤵
        
        PID:5420
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        75⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        70⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        71⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        71⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        72⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        73⤵
        
        PID:3972
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        74⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        69⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        70⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        70⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        71⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        72⤵
        
        PID:7560
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        73⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        68⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        69⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        69⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        70⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        71⤵
        
        PID:196
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        72⤵
        
        PID:4620
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        72⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        67⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        68⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        68⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        69⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        70⤵
        
        PID:8388
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        71⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        66⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        67⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        67⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        68⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        69⤵
        
        PID:8440
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        70⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        65⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        66⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        66⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        67⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        68⤵
        
        PID:7244
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        69⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        64⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        65⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        65⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        66⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        67⤵
        
        PID:8372
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        68⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        63⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        64⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        64⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        65⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        66⤵
        
        PID:8408
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        67⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        62⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        63⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        63⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        64⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        65⤵
        
        PID:8512
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        66⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        61⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        62⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        62⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        63⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        64⤵
        
        PID:8376
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        65⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        60⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        61⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        61⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        62⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        63⤵
        
        PID:8476
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        64⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        59⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        60⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        60⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        61⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        62⤵
        
        PID:5808
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        63⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        58⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        59⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        59⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        60⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        61⤵
        
        PID:8664
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        62⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        57⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        58⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        58⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        59⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        60⤵
        
        PID:1760
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        61⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        56⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        57⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        57⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        58⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        59⤵
        
        PID:5608
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        60⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        55⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        56⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        56⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        57⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        58⤵
        
        PID:10168
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        59⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        54⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        55⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        55⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        56⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        57⤵
        
        PID:5212
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        58⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        53⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        54⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        54⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        55⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        56⤵
        
        PID:1180
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        57⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        52⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        53⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        53⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        54⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        55⤵
        
        PID:3976
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        56⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        51⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        52⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        52⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        53⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        54⤵
        
        PID:10036
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        55⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        50⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        51⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        51⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        52⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        53⤵
        
        PID:1252
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        54⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        49⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        50⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        50⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        51⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        52⤵
        
        PID:9688
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        53⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        48⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        49⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        49⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        50⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        51⤵
        
        PID:7460
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        52⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        47⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        48⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        48⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        49⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        50⤵
        
        PID:5572
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        51⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        46⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        47⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        47⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        48⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        49⤵
        
        PID:5472
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        50⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        45⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        46⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        46⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        47⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        48⤵
        
        PID:5388
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        49⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        44⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        45⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        45⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        46⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        47⤵
        
        PID:9152
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        48⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        43⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        44⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        44⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        45⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        46⤵
        
        PID:5668
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        47⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        42⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        43⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        43⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        44⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        45⤵
        
        PID:6708
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        46⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        41⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        42⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        42⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        43⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        44⤵
        
        PID:10224
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        45⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        40⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        41⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        41⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        42⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        43⤵
        
        PID:2904
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        44⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        39⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        40⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        40⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        41⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        42⤵
        
        PID:9952
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        43⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        38⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        39⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        39⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        40⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        41⤵
        
        PID:9788
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        42⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        37⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        38⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        38⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        39⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        40⤵
        
        PID:9716
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        41⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        36⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        37⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        37⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        38⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        39⤵
        
        PID:9692
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        40⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        35⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        36⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        36⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        37⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        38⤵
        
        PID:9588
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        39⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        34⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        35⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        35⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        36⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        37⤵
        
        PID:9504
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        38⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        33⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        34⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        34⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        35⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        36⤵
        
        PID:9424
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        37⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        32⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        33⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        33⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        34⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        35⤵
        
        PID:9264
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        36⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        31⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        32⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        32⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        33⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        34⤵
        
        PID:9432
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        35⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        30⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        31⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        31⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        32⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        33⤵
        
        PID:9056
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        34⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        29⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        30⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        30⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        31⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        32⤵
        
        PID:9160
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        33⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        28⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        29⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        29⤵
        
        PID:592
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        30⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        31⤵
        
        PID:4880
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        32⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        27⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        28⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        28⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        29⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        30⤵
        
        PID:8040
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        31⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        26⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        27⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        27⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        28⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        29⤵
        
        PID:1692
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        30⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        25⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        26⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        26⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        27⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        28⤵
        
        PID:4816
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        29⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        24⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        25⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        25⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        26⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        27⤵
        
        PID:5024
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        28⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        23⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        24⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        24⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        25⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        26⤵
        
        PID:8300
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        27⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        22⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        23⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        23⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        24⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        25⤵
        
        PID:4000
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        26⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        21⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        22⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        22⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        23⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        24⤵
        
        PID:8940
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        25⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        20⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        21⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        21⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        22⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        23⤵
        
        PID:8896
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        24⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        19⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        20⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        20⤵
        
        PID:196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        21⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        22⤵
        
        PID:4340
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        23⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        18⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        19⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        19⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        20⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        21⤵
        
        PID:8328
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        22⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        17⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        18⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        18⤵
        
        PID:704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        19⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        20⤵
        
        PID:8200
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        21⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        16⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        17⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        18⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        19⤵
        
        PID:9128
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        20⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        15⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        16⤵
        Executes dropped EXE
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        17⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        18⤵
        
        PID:7936
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        19⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        14⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        15⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        16⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        17⤵
        
        PID:7292
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        18⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        13⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        14⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        15⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        16⤵
        
        PID:8956
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        17⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        12⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        13⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        14⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        15⤵
        
        PID:8476
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        16⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        11⤵
        Executes dropped EXE
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        12⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        13⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        14⤵
        
        PID:8372
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        15⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        10⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        11⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        12⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        13⤵
        
        PID:4916
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        14⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        9⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        10⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        11⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        12⤵
        
        PID:7180
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        13⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        8⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        9⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        10⤵
        
        PID:216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        11⤵
        
        PID:7704
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        12⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        7⤵
        Executes dropped EXE
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        8⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        9⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        10⤵
        
        PID:4100
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        11⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        7⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        8⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        9⤵
        
        PID:7800
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        10⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        6⤵
        Executes dropped EXE
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        8⤵
        
        PID:7536
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        9⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
      "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        5⤵
        Executes dropped EXE
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        6⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        7⤵
        
        PID:7340
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        8⤵
        
        PID:7560
- - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
    "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
      "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
      4⤵
      Executes dropped EXE
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
      "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:344
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        5⤵
        
        PID:4804
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        6⤵
        
        PID:6260
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        7⤵
        
        PID:6040
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\njamjy1d\njamjy1d.cmdline"
        8⤵
        
        PID:7708
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB94D.tmp" "c:\Windows\System32\CSC862AE4CCC5104E65BD5A475EC0A1BECD.TMP"
        9⤵
        
        PID:7028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\21PbmSNUzw.bat"
        8⤵
        
        PID:9188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:8224
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:7512
        
        C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe
        
        "C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe"
        9⤵
        
        PID:9356
- C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
  "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
    "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
    3⤵
    - Executes dropped EXE
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
    "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
      4⤵
      PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        5⤵
        
        PID:6304
      - C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        6⤵
        
        PID:7200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 11 /tr "'C:\Webnet\3b73a6fa2092a350d795.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\Webnet\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 11 /tr "'C:\Webnet\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Webnet\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Webnet\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 6 /tr "'C:\Webnet\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 14 /tr "'C:\Webnet\portmonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitor" /sc ONLOGON /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 10 /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:9052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe

Filesize
5.2MB

MD5
b86bbb42b26e72a601087f68cda89208

SHA1
baca49e35da3b83cd56ba579d61f98e9b137debe

SHA256
320eff01b2a5b520853cd9b0c7486b3d9992dce2f9308f267069a60f88f8deb0

SHA512
e98dfeb55d6053d6e2ec323f4665b4ea8cdb5bae0807ac70ac5dbb6cf7f3e8e1ba6a2ad099f8232b0e0ca9a738a9baf7d132957fb5d503c78283b229e35ed974

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe

Filesize
8.7MB

MD5
57ec49d438753f3bdfec6a616258b370

SHA1
a34f757f5f2bd4763f04206c0d0cd32ab4491117

SHA256
872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

SHA512
88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\leetcrack.exe

Filesize
8.7MB

MD5
93144ffd83e528ff8651605be2d2c1a4

SHA1
6c661ce690ecd3ecd21c8953e410543fcf8a69ad

SHA256
4ded33a5b292e88739e50c25c4db2ec8a4b444b21431f3daba87a2573965bd60

SHA512
5236edcac0e56126c0f83eccc930a96548788694e1505ee0f74e77ed41582b1c92573de2fef0bf1e69fa3e9bc355f45f4671a67da66612e1a24b8eb849ea668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\portmonitor.exe

Filesize
3.8MB

MD5
3d686dda8f890bef092779bc682dec10

SHA1
2e6f12de7a5d4febe798a63b2f8914458741bf7f

SHA256
af9b7828f0661720eeaac5931f160f7db17dbf6c1ddcd7020a0c06a4deb2b7d4

SHA512
cb32222a74d01de5c99e5096e1e00f86ab54af0db9e6b560b5952de2ab1c654ebde7331e80302dedb387acc7ad7c98eae3748cf3bf2bb78c1d0a5088db881f58

Download Submit
C:\Webnet\3b73a6fa2092a350d795.exe

Filesize
3.5MB

MD5
aa6c98cd853bf585a410394fd10817dc

SHA1
ceab1865997ae2c6e070a9c6adf6b129cf2ad383

SHA256
fc45eebea5ae88160a2ac49fe7e027baeee028c4f4b021794726a04ecea8c90b

SHA512
2ada05425dce38fd9fe48c9ceb6a21c59c5e7088274c4445dfde054974f14f8feba5012909c5a75d7932a6bcbb488e38d34d9c970cd61c636ee13abc59e06562

Download Submit
C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe

Filesize
209B

MD5
1fefc5b72cd89c9f83dcf8a47b254f58

SHA1
909c965e493baab2203bac16be714cfb88a75f0d

SHA256
7f03a5563b7186e6c6efa09392c843783b9a3375bcfbe29e4b9c8fc6f3032c3c

SHA512
5bada5c497c306276c348569995cb254b3e6dcf2a8c10e48eadded26b69e7d5690503b8d9610f46b91a28effbe4be8d7345938d8c59d9f5343186f4d60e526ca

Download Submit
memory/1804-29-0x00007FF62EAB0000-0x00007FF62F6DA000-memory.dmp

Filesize
12.2MB

Download
memory/2680-1140-0x0000000002780000-0x000000000282E000-memory.dmp

Filesize
696KB

Download
memory/2680-1141-0x0000000002780000-0x00000000028CA000-memory.dmp

Filesize
1.3MB

Download
memory/2680-1051-0x0000000000CD0000-0x0000000000E1A000-memory.dmp

Filesize
1.3MB

Download
memory/2680-1050-0x0000000000CD0000-0x0000000000D7E000-memory.dmp

Filesize
696KB

Download
memory/6040-311-0x000000001BF40000-0x000000001BF9A000-memory.dmp

Filesize
360KB

Download
memory/6040-325-0x000000001C010000-0x000000001C05E000-memory.dmp

Filesize
312KB

Download
memory/6040-296-0x000000001B900000-0x000000001B912000-memory.dmp

Filesize
72KB

Download
memory/6040-298-0x000000001B8E0000-0x000000001B8F0000-memory.dmp

Filesize
64KB

Download
memory/6040-300-0x000000001BEA0000-0x000000001BEB6000-memory.dmp

Filesize
88KB

Download
memory/6040-302-0x000000001BEC0000-0x000000001BED2000-memory.dmp

Filesize
72KB

Download
memory/6040-305-0x000000001B8F0000-0x000000001B8FE000-memory.dmp

Filesize
56KB

Download
memory/6040-294-0x000000001B8D0000-0x000000001B8DE000-memory.dmp

Filesize
56KB

Download
memory/6040-315-0x000000001BEE0000-0x000000001BEEE000-memory.dmp

Filesize
56KB

Download
memory/6040-317-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Filesize
64KB

Download
memory/6040-321-0x000000001BFA0000-0x000000001BFB8000-memory.dmp

Filesize
96KB

Download
memory/6040-319-0x000000001BF00000-0x000000001BF0E000-memory.dmp

Filesize
56KB

Download
memory/6040-323-0x000000001BF10000-0x000000001BF1C000-memory.dmp

Filesize
48KB

Download
memory/6040-288-0x000000001B8B0000-0x000000001B8C8000-memory.dmp

Filesize
96KB

Download
memory/6040-292-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/6040-309-0x000000001B930000-0x000000001B940000-memory.dmp

Filesize
64KB

Download
memory/6040-307-0x000000001B920000-0x000000001B930000-memory.dmp

Filesize
64KB

Download
memory/6040-303-0x000000001C410000-0x000000001C936000-memory.dmp

Filesize
5.1MB

Download
memory/6040-286-0x0000000002F50000-0x0000000002F60000-memory.dmp

Filesize
64KB

Download
memory/6040-281-0x000000001B890000-0x000000001B8AC000-memory.dmp

Filesize
112KB

Download
memory/6040-275-0x0000000002F80000-0x0000000002FA6000-memory.dmp

Filesize
152KB

Download
memory/6040-290-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/6040-282-0x000000001BE50000-0x000000001BEA0000-memory.dmp

Filesize
320KB

Download
memory/6040-279-0x0000000002DF0000-0x0000000002DFE000-memory.dmp

Filesize
56KB

Download
memory/6040-271-0x00000000009B0000-0x0000000000D3E000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads