f9cf48c044d90c94f4814a0577cc36a7ba1ac5dbc9652b2e0e498162a042494d

Analysis

max time kernel
77s
max time network
153s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
19-03-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

72.0MB
MD5

043e915471323e762e76803853cda28e
SHA1

8ec1f578b126764217dc696c82a2e0dab6f3b906
SHA256

3b6c17f5720f2db7a5b695486da9f5d298c35ab9a274a5760f5191d24f3188bd
SHA512

f61d0c6408f0be97519ef8127f5130b28965272c15124a3953a9579bc8e92c79dadbfcc92f5b520a745736a218995be98245654440fd794d4085410eea18bb00
SSDEEP

1572864:FejOS3vf8SEuUfuVpWO9cC4LG8UzK+uxoG+YYfeGn+yn0N:F+HEWp0C4LGnsX+YYR+dN

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Control Panel\International\Geo\Nation	Launcher.exe

Executes dropped EXE 4 IoCs

pid	Process
1252	Launcher.exe
2984	Launcher.exe
1060	Launcher.exe
5076	Launcher.exe

Loads dropped DLL 13 IoCs

pid	Process
4560	Launcher.exe
4560	Launcher.exe
4560	Launcher.exe
1252	Launcher.exe
1252	Launcher.exe
2984	Launcher.exe
2984	Launcher.exe
2984	Launcher.exe
2984	Launcher.exe
2984	Launcher.exe
1060	Launcher.exe
5076	Launcher.exe
1252	Launcher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ipinfo.io
31	ipinfo.io
2	ipinfo.io
8	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
7464	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4560	Launcher.exe
Token: SeIncreaseQuotaPrivilege	3168	WMIC.exe
Token: SeSecurityPrivilege	3168	WMIC.exe
Token: SeTakeOwnershipPrivilege	3168	WMIC.exe
Token: SeLoadDriverPrivilege	3168	WMIC.exe
Token: SeSystemProfilePrivilege	3168	WMIC.exe
Token: SeSystemtimePrivilege	3168	WMIC.exe
Token: SeProfSingleProcessPrivilege	3168	WMIC.exe
Token: SeIncBasePriorityPrivilege	3168	WMIC.exe
Token: SeCreatePagefilePrivilege	3168	WMIC.exe
Token: SeBackupPrivilege	3168	WMIC.exe
Token: SeRestorePrivilege	3168	WMIC.exe
Token: SeShutdownPrivilege	3168	WMIC.exe
Token: SeDebugPrivilege	3168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3168	WMIC.exe
Token: SeRemoteShutdownPrivilege	3168	WMIC.exe
Token: SeUndockPrivilege	3168	WMIC.exe
Token: SeManageVolumePrivilege	3168	WMIC.exe
Token: 33	3168	WMIC.exe
Token: 34	3168	WMIC.exe
Token: 35	3168	WMIC.exe
Token: 36	3168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3168	WMIC.exe
Token: SeSecurityPrivilege	3168	WMIC.exe
Token: SeTakeOwnershipPrivilege	3168	WMIC.exe
Token: SeLoadDriverPrivilege	3168	WMIC.exe
Token: SeSystemProfilePrivilege	3168	WMIC.exe
Token: SeSystemtimePrivilege	3168	WMIC.exe
Token: SeProfSingleProcessPrivilege	3168	WMIC.exe
Token: SeIncBasePriorityPrivilege	3168	WMIC.exe
Token: SeCreatePagefilePrivilege	3168	WMIC.exe
Token: SeBackupPrivilege	3168	WMIC.exe
Token: SeRestorePrivilege	3168	WMIC.exe
Token: SeShutdownPrivilege	3168	WMIC.exe
Token: SeDebugPrivilege	3168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3168	WMIC.exe
Token: SeRemoteShutdownPrivilege	3168	WMIC.exe
Token: SeUndockPrivilege	3168	WMIC.exe
Token: SeManageVolumePrivilege	3168	WMIC.exe
Token: 33	3168	WMIC.exe
Token: 34	3168	WMIC.exe
Token: 35	3168	WMIC.exe
Token: 36	3168	WMIC.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe
Token: SeCreatePagefilePrivilege	1252	Launcher.exe
Token: SeShutdownPrivilege	1252	Launcher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1252	4560	Launcher.exe	73
PID 4560 wrote to memory of 1252	4560	Launcher.exe	73
PID 1252 wrote to memory of 4460	1252	Launcher.exe	126
PID 1252 wrote to memory of 4460	1252	Launcher.exe	126
PID 4460 wrote to memory of 3168	4460	cmd.exe	164
PID 4460 wrote to memory of 3168	4460	cmd.exe	164
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 2984	1252	Launcher.exe	79
PID 1252 wrote to memory of 1060	1252	Launcher.exe	80
PID 1252 wrote to memory of 1060	1252	Launcher.exe	80
PID 1252 wrote to memory of 5076	1252	Launcher.exe	81
PID 1252 wrote to memory of 5076	1252	Launcher.exe	81
PID 1252 wrote to memory of 1660	1252	Launcher.exe	82
PID 1252 wrote to memory of 1660	1252	Launcher.exe	82
PID 1252 wrote to memory of 3532	1252	Launcher.exe	661
PID 1252 wrote to memory of 3532	1252	Launcher.exe	661
PID 1252 wrote to memory of 5040	1252	Launcher.exe	659
PID 1252 wrote to memory of 5040	1252	Launcher.exe	659
PID 1252 wrote to memory of 4036	1252	Launcher.exe	85
PID 1252 wrote to memory of 4036	1252	Launcher.exe	85
PID 1252 wrote to memory of 3816	1252	Launcher.exe	86
PID 1252 wrote to memory of 3816	1252	Launcher.exe	86
PID 1252 wrote to memory of 5008	1252	Launcher.exe	87
PID 1252 wrote to memory of 5008	1252	Launcher.exe	87
PID 1252 wrote to memory of 2268	1252	Launcher.exe	441
PID 1252 wrote to memory of 2268	1252	Launcher.exe	441
PID 1252 wrote to memory of 3332	1252	Launcher.exe	89
PID 1252 wrote to memory of 3332	1252	Launcher.exe	89
PID 1252 wrote to memory of 2336	1252	Launcher.exe	664
PID 1252 wrote to memory of 2336	1252	Launcher.exe	664
PID 1252 wrote to memory of 4180	1252	Launcher.exe	91
PID 1252 wrote to memory of 4180	1252	Launcher.exe	91
PID 1252 wrote to memory of 4864	1252	Launcher.exe	442
PID 1252 wrote to memory of 4864	1252	Launcher.exe	442
PID 1252 wrote to memory of 3892	1252	Launcher.exe	548
PID 1252 wrote to memory of 3892	1252	Launcher.exe	548

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe
  C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic CsProduct Get UUID
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1820 --field-trial-handle=1824,i,9140946775585584166,15380800066523090624,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=2828 --field-trial-handle=1824,i,9140946775585584166,15380800066523090624,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2964 --field-trial-handle=1824,i,9140946775585584166,15380800066523090624,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-qvwr90.hkp5n.jpg" "
    3⤵
    PID:1660
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:5988
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA758.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC07EDC22ADF0457FA821562BE5D64EE.TMP"
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-qvwr90.hkp5n.jpg"
      4⤵
      PID:7048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-m7b2kt.0drmj.jpg" "
    3⤵
    PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-m7b2kt.0drmj.jpg"
      4⤵
      PID:6788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1mkwhc8.j326.jpg" "
    3⤵
    PID:5040
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6980
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE2D.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC6ADB1CFD8FB2483E83CDC2EA9829583A.TMP"
        5⤵
        
        PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8nb6m1.4clqi.jpg" "
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8nb6m1.4clqi.jpg"
      4⤵
      PID:6644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1knslc1.hv1z.jpg" "
    3⤵
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1knslc1.hv1z.jpg"
      4⤵
      PID:7064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17saye6.myjal.jpg" "
    3⤵
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17saye6.myjal.jpg"
      4⤵
      PID:6296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1bc9z3r.slkn.jpg" "
    3⤵
    PID:2268
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6940
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3F9.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC5EEC77222F504E5BA331925F2A5BAB4E.TMP"
        5⤵
        
        PID:8016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1dtmaru.i6yf.jpg" "
    3⤵
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1dtmaru.i6yf.jpg"
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16r4f7r.6tqp.jpg" "
    3⤵
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16r4f7r.6tqp.jpg"
      4⤵
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1oqreuf.u1imh.jpg" "
    3⤵
    PID:4180
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6932
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB040.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC3C7EEA7E7204D59ADE2AF52ACC098.TMP"
        5⤵
        
        PID:7540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-126zes3.q7t4.jpg" "
    3⤵
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-126zes3.q7t4.jpg"
      4⤵
      PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1xjzn84.sllzf.jpg" "
    3⤵
    PID:3892
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6704
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACA6.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC43946F9D13654046A5E51946BF91BB.TMP"
        5⤵
        
        PID:6684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-58lakk.teg36.jpg" "
    3⤵
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-58lakk.teg36.jpg"
      4⤵
      PID:6740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17h0z56.rp1s.jpg" "
    3⤵
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17h0z56.rp1s.jpg"
      4⤵
      PID:7108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uemrib.76i.jpg" "
    3⤵
    PID:4132
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uemrib.76i.jpg"
      4⤵
      PID:6752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ycd2cd.z7eh.jpg" "
    3⤵
    PID:652
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6488
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB9D.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC8CC94D286FE542CEA3835394D8729165.TMP"
        5⤵
        
        PID:6648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uwsatk.xbs8.jpg" "
    3⤵
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uwsatk.xbs8.jpg"
      4⤵
      PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-130rvnl.0jls.jpg" "
    3⤵
    PID:2536
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6376
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA89F.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC84B9D17CF7DB4C878F7636142FB2F99B.TMP"
        5⤵
        
        PID:6792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17awe6c.5rps.jpg" "
    3⤵
    PID:200
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17awe6c.5rps.jpg"
      4⤵
      PID:6444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17rq5uj.w3i1.jpg" "
    3⤵
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17rq5uj.w3i1.jpg"
      4⤵
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-zy981t.iqgn.jpg" "
    3⤵
    PID:1152
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6532
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA35.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC9386E9DF2C364BDDA3A8B57D174C57E.TMP"
        5⤵
        
        PID:7128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1opqfta.0zz4.jpg" "
    3⤵
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1opqfta.0zz4.jpg"
      4⤵
      PID:6620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-wbpkrk.iw08e.jpg" "
    3⤵
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-wbpkrk.iw08e.jpg"
      4⤵
      PID:6832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-mm04qn.d88g.jpg" "
    3⤵
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-mm04qn.d88g.jpg"
      4⤵
      PID:7084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1huty7o.7oww.jpg" "
    3⤵
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1huty7o.7oww.jpg"
      4⤵
      PID:6724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1jyce9v.lhgz.jpg" "
    3⤵
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1jyce9v.lhgz.jpg"
      4⤵
      PID:6748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1eah1tq.wdv2l.jpg" "
    3⤵
    PID:1580
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6368
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA757.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC9DCC88AC7A43B5ACB5A3E76CDD70DE.TMP"
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1eah1tq.wdv2l.jpg"
      4⤵
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-by35io.t4u6q.jpg" "
    3⤵
    PID:4528
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6440
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA851.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCD32B3EB0F11F446AB122E6ECB55C258.TMP"
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-by35io.t4u6q.jpg"
      4⤵
      PID:6596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-swokx9.rb46n.jpg" "
    3⤵
    PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-swokx9.rb46n.jpg"
      4⤵
      PID:6576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1c5sb4.wfe2f.jpg" "
    3⤵
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1c5sb4.wfe2f.jpg"
      4⤵
      PID:6904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-h2dqcj.ywlgt.jpg" "
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-h2dqcj.ywlgt.jpg"
      4⤵
      PID:7248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-hduej4.wmu3p.jpg" "
    3⤵
    PID:2660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3168
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6496
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA860.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCA6CC16BB2E8E423F96F9A9B9F6D24FAD.TMP"
        5⤵
        
        PID:6756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ni548g.5lm3i.jpg" "
    3⤵
    PID:2892
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6304
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA766.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCDC46734538B444085B25A5292294A12.TMP"
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ni548g.5lm3i.jpg"
      4⤵
      PID:6744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-10bnpo6.w596.jpg" "
    3⤵
    PID:5060
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6688
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAA3.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC36CA8506A0334C4B96717E6D3F954FA.TMP"
        5⤵
        
        PID:6544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-i5anxb.98hy.jpg" "
    3⤵
    PID:2888
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6508
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA96A.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCDCF8EA951C6D4B8CA72ACC56C0ABCF50.TMP"
        5⤵
        
        PID:6916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ti1h78.pvx68.jpg" "
    3⤵
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ti1h78.pvx68.jpg"
      4⤵
      PID:7096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1b7asqr.byzv.jpg" "
    3⤵
    PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1b7asqr.byzv.jpg"
      4⤵
      PID:6396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16lk9mc.kuy3.jpg" "
    3⤵
    PID:2364
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6252
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA728.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCEFA2F9EDFEAF42688C29FA858605FE1.TMP"
        5⤵
        
        PID:6604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-7ogq4x.f5bsc.jpg" "
    3⤵
    PID:3712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6336
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA709.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC25016A8EC6B44C00B67D889F953BB761.TMP"
        5⤵
        
        PID:6580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ifz6h9.58slk.jpg" "
    3⤵
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ifz6h9.58slk.jpg"
      4⤵
      PID:6368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-aw6wvm.obah.jpg" "
    3⤵
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-aw6wvm.obah.jpg"
      4⤵
      PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-oblv1m.nkffd.jpg" "
    3⤵
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-oblv1m.nkffd.jpg"
      4⤵
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-171rl6.ad7bx.jpg" "
    3⤵
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-171rl6.ad7bx.jpg"
      4⤵
      PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-fqb3kn.oanfb.jpg" "
    3⤵
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-fqb3kn.oanfb.jpg"
      4⤵
      PID:6584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-q1r4jn.8qrl.jpg" "
    3⤵
    PID:4012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6352
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6F9.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC9868CC9CAC5B408F979615A9F3A258B2.TMP"
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-q1r4jn.8qrl.jpg"
      4⤵
      PID:6384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1mh369c.vc7rk.jpg" "
    3⤵
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1mh369c.vc7rk.jpg"
      4⤵
      PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ioc7mh.4y1l.jpg" "
    3⤵
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ioc7mh.4y1l.jpg"
      4⤵
      PID:6344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-o515la.vldtr.jpg" "
    3⤵
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-o515la.vldtr.jpg"
      4⤵
      PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-14di9sc.ll7v.jpg" "
    3⤵
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-14di9sc.ll7v.jpg"
      4⤵
      PID:6512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-19q5y1v.u2qq.jpg" "
    3⤵
    PID:696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6520
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA06.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCECD6EAFC7E19442A99C76E886FA9E7B.TMP"
        5⤵
        
        PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-143lrj5.v9aw.jpg" "
    3⤵
    PID:1680
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6632
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABDB.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC42C46C5973064B798D4D9A2E52B20A9.TMP"
        5⤵
        
        PID:6848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-naw4wg.dnvu7.jpg" "
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-naw4wg.dnvu7.jpg"
      4⤵
      PID:6760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-64xj8r.s1v6k.jpg" "
    3⤵
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-64xj8r.s1v6k.jpg"
      4⤵
      PID:6304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1g8dib8.pbns.jpg" "
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1g8dib8.pbns.jpg"
      4⤵
      PID:7492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6i65iz.mimwx.jpg" "
    3⤵
    PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6i65iz.mimwx.jpg"
      4⤵
      PID:7600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-12ei47k.7191.jpg" "
    3⤵
    PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-12ei47k.7191.jpg"
      4⤵
      PID:7756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-189k9nz.fp62.jpg" "
    3⤵
    PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-189k9nz.fp62.jpg"
      4⤵
      PID:7764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-qndwv.kw3ak.jpg" "
    3⤵
    PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-qndwv.kw3ak.jpg"
      4⤵
      PID:6716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1b1q8h6.e64uh.jpg" "
    3⤵
    PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1b1q8h6.e64uh.jpg"
      4⤵
      PID:7420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-190600.geljb.jpg" "
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-190600.geljb.jpg"
      4⤵
      PID:6324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-zi07fq.r74f8.jpg" "
    3⤵
    PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-zi07fq.r74f8.jpg"
      4⤵
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6h2ehl.ak54h.jpg" "
    3⤵
    PID:5416
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9A9.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCA1530B22317947F7AEF3D8721A2795C6.TMP"
        5⤵
        
        PID:6972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16xrug5.sab.jpg" "
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16xrug5.sab.jpg"
      4⤵
      PID:7260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-swamrw.doesl.jpg" "
    3⤵
    PID:5456
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:6924
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB021.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCCAE2E8F9D2CC4C1894B7FC9BFF0506B.TMP"
        5⤵
        
        PID:7512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1jvqnw8.0v7o.jpg" "
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1jvqnw8.0v7o.jpg"
      4⤵
      PID:7408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-wl2tjs.5fny.jpg" "
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-wl2tjs.5fny.jpg"
      4⤵
      PID:7816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18vho7b.m7ky.jpg" "
    3⤵
    PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18vho7b.m7ky.jpg"
      4⤵
      PID:7592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uuri2x.g2kx.jpg" "
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uuri2x.g2kx.jpg"
      4⤵
      PID:7772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:5908
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
      4⤵
      PID:6328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
    3⤵
    PID:5916
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
      4⤵
      PID:6260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
    3⤵
    PID:5924
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
      4⤵
      PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
    3⤵
    PID:6952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:7464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
    3⤵
    PID:6340
  - - C:\Windows\system32\cmd.exe
      cmd /c chcp 65001
      4⤵
      PID:2664
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:7112
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17xc1i7.1pbp.jpg" "
    3⤵
    PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17xc1i7.1pbp.jpg"
      4⤵
      PID:6812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1d9ghdm.qe65.jpg" "
    3⤵
    PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1d9ghdm.qe65.jpg"
      4⤵
      PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5imkcj.4p6tq.jpg" "
    3⤵
    PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5imkcj.4p6tq.jpg"
      4⤵
      PID:7320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1yooibe.bdcj.jpg" "
    3⤵
    PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1yooibe.bdcj.jpg"
      4⤵
      PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-e2abpc.3e6fe.jpg" "
    3⤵
    PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-e2abpc.3e6fe.jpg"
      4⤵
      PID:6784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1cujz7d.rwz4.jpg" "
    3⤵
    PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1cujz7d.rwz4.jpg"
      4⤵
      PID:7220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1p1o4am.9j5uf.jpg" "
    3⤵
    PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1p1o4am.9j5uf.jpg"
      4⤵
      PID:7480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lbadz6.qnic.jpg" "
    3⤵
    PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lbadz6.qnic.jpg"
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-gchsz.vy78hc.jpg" "
    3⤵
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-gchsz.vy78hc.jpg"
      4⤵
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-yvb1b6.qhvhi.jpg" "
    3⤵
    PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-yvb1b6.qhvhi.jpg"
      4⤵
      PID:8040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-13zuc49.c8dm.jpg" "
    3⤵
    PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-13zuc49.c8dm.jpg"
      4⤵
      PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bu6ulx.0u3j7.jpg" "
    3⤵
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bu6ulx.0u3j7.jpg"
      4⤵
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vhx1a0.9lles.jpg" "
    3⤵
    PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vhx1a0.9lles.jpg"
      4⤵
      PID:7760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1yjobwr.v71ll.jpg" "
    3⤵
    PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1yjobwr.v71ll.jpg"
      4⤵
      PID:7444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-m4yhkx.3rixb.jpg" "
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-m4yhkx.3rixb.jpg"
      4⤵
      PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-nztjo0.w91mq.jpg" "
    3⤵
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-nztjo0.w91mq.jpg"
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uk3tgt.n6qh.jpg" "
    3⤵
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uk3tgt.n6qh.jpg"
      4⤵
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5pgdi3.2zhap.jpg" "
    3⤵
    PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5pgdi3.2zhap.jpg"
      4⤵
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-crye97.yz5vr.jpg" "
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-crye97.yz5vr.jpg"
      4⤵
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1fvlkox.sg8fk.jpg" "
    3⤵
    PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1fvlkox.sg8fk.jpg"
      4⤵
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lti9it.okhh.jpg" "
    3⤵
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lti9it.okhh.jpg"
      4⤵
      PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1v0zhw0.m5cf.jpg" "
    3⤵
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1v0zhw0.m5cf.jpg"
      4⤵
      PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1oz2kpy.chjw.jpg" "
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1oz2kpy.chjw.jpg"
      4⤵
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1hzq7eg.2no1.jpg" "
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1hzq7eg.2no1.jpg"
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-u5hmy9.j91x.jpg" "
    3⤵
    PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-u5hmy9.j91x.jpg"
      4⤵
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1v85oe1.x5c2.jpg" "
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1v85oe1.x5c2.jpg"
      4⤵
      PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-149q6.zpb5z3.jpg" "
    3⤵
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-149q6.zpb5z3.jpg"
      4⤵
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-azidgs.lqwoe.jpg" "
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-azidgs.lqwoe.jpg"
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-14dutf1.2dtz.jpg" "
    3⤵
    PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-14dutf1.2dtz.jpg"
      4⤵
      PID:6500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-g5wm55.nwtj.jpg" "
    3⤵
    PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-g5wm55.nwtj.jpg"
      4⤵
      PID:6732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-jk187w.fg0j.jpg" "
    3⤵
    PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-jk187w.fg0j.jpg"
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18wg9r9.62zv.jpg" "
    3⤵
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18wg9r9.62zv.jpg"
      4⤵
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1xwisdc.0jzb.jpg" "
    3⤵
    PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1xwisdc.0jzb.jpg"
      4⤵
      PID:7492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-puof0v.4k86g.jpg" "
    3⤵
    PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-puof0v.4k86g.jpg"
      4⤵
      PID:6776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5ezdyj.jug2q.jpg" "
    3⤵
    PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5ezdyj.jug2q.jpg"
      4⤵
      PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1mf8rax.atxk.jpg" "
    3⤵
    PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1mf8rax.atxk.jpg"
      4⤵
      PID:8012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-srae6m.dg60j.jpg" "
    3⤵
    PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-srae6m.dg60j.jpg"
      4⤵
      PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1gwpvyw.1ewc.jpg" "
    3⤵
    PID:2268
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1gwpvyw.1ewc.jpg"
      4⤵
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vjym36.ei3f.jpg" "
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vjym36.ei3f.jpg"
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16o5nla.q3l5.jpg" "
    3⤵
    PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16o5nla.q3l5.jpg"
      4⤵
      PID:7368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-xd03z5.mbuy8.jpg" "
    3⤵
    PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-xd03z5.mbuy8.jpg"
      4⤵
      PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17wd7xx.uo7y.jpg" "
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-17wd7xx.uo7y.jpg"
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1227zpz.yysz.jpg" "
    3⤵
    PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1227zpz.yysz.jpg"
      4⤵
      PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vdiua5.3z9tf.jpg" "
    3⤵
    PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vdiua5.3z9tf.jpg"
      4⤵
      PID:7292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-dx62z9.5yfon.jpg" "
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-dx62z9.5yfon.jpg"
      4⤵
      PID:7436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3rymqm.abmqf.jpg" "
    3⤵
    PID:204
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3rymqm.abmqf.jpg"
      4⤵
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-h4gb2d.28vgm.jpg" "
    3⤵
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-h4gb2d.28vgm.jpg"
      4⤵
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3crkvt.h0x0q.jpg" "
    3⤵
    PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3crkvt.h0x0q.jpg"
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-fxdi4y.jyqtt.jpg" "
    3⤵
    PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-fxdi4y.jyqtt.jpg"
      4⤵
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ea074d.1ap9v.jpg" "
    3⤵
    PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ea074d.1ap9v.jpg"
      4⤵
      PID:7852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1i2wz2q.yj9d.jpg" "
    3⤵
    PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1i2wz2q.yj9d.jpg"
      4⤵
      PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-11n8su3.rqyff.jpg" "
    3⤵
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-11n8su3.rqyff.jpg"
      4⤵
      PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-4ndgf3.kvxjx.jpg" "
    3⤵
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-4ndgf3.kvxjx.jpg"
      4⤵
      PID:6436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1lg4alt.t009.jpg" "
    3⤵
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1lg4alt.t009.jpg"
      4⤵
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-iwh9o8.o35h.jpg" "
    3⤵
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-iwh9o8.o35h.jpg"
      4⤵
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uiqnre.bycf.jpg" "
    3⤵
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uiqnre.bycf.jpg"
      4⤵
      PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ddx9o5.que.jpg" "
    3⤵
    PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ddx9o5.que.jpg"
      4⤵
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1qxef7e.365x.jpg" "
    3⤵
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1qxef7e.365x.jpg"
      4⤵
      PID:496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ovhmom.5jov.jpg" "
    3⤵
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ovhmom.5jov.jpg"
      4⤵
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1eod8gs.kj5o.jpg" "
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1eod8gs.kj5o.jpg"
      4⤵
      PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-19dp1ui.4agd.jpg" "
    3⤵
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-19dp1ui.4agd.jpg"
      4⤵
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5th81h.w1vin.jpg" "
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5th81h.w1vin.jpg"
      4⤵
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-l7eyb0.522ok.jpg" "
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-l7eyb0.522ok.jpg"
      4⤵
      PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1pb2hah.riui.jpg" "
    3⤵
    PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1pb2hah.riui.jpg"
      4⤵
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-12bvrxy.heuu.jpg" "
    3⤵
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-12bvrxy.heuu.jpg"
      4⤵
      PID:6984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-orwun4.7idv8.jpg" "
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-orwun4.7idv8.jpg"
      4⤵
      PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5x3159.gmygb.jpg" "
    3⤵
    PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5x3159.gmygb.jpg"
      4⤵
      PID:6704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-nm4z03.10ga.jpg" "
    3⤵
    PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-nm4z03.10ga.jpg"
      4⤵
      PID:6344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-sdcea5.xf1nc.jpg" "
    3⤵
    PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-sdcea5.xf1nc.jpg"
      4⤵
      PID:7260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bymka9.hveha.jpg" "
    3⤵
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bymka9.hveha.jpg"
      4⤵
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-d1vc91.bsgp9.jpg" "
    3⤵
    PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-d1vc91.bsgp9.jpg"
      4⤵
      PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1g0o2om.27xm.jpg" "
    3⤵
    PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1g0o2om.27xm.jpg"
      4⤵
      PID:7956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-103sceo.cvnj.jpg" "
    3⤵
    PID:5416
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-103sceo.cvnj.jpg"
      4⤵
      PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-a06ji3.o0f2.jpg" "
    3⤵
    PID:5376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-a06ji3.o0f2.jpg"
      4⤵
      PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lf2j13.8nts.jpg" "
    3⤵
    PID:5832
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lf2j13.8nts.jpg"
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1q40bce.sejp.jpg" "
    3⤵
    PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1q40bce.sejp.jpg"
      4⤵
      PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-748653.lq9rh.jpg" "
    3⤵
    PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-748653.lq9rh.jpg"
      4⤵
      PID:7516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-u4oity.ud3un.jpg" "
    3⤵
    PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-u4oity.ud3un.jpg"
      4⤵
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-u3irsj.kfg.jpg" "
    3⤵
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-u3irsj.kfg.jpg"
      4⤵
      PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-7oykhj.nralf.jpg" "
    3⤵
    PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-7oykhj.nralf.jpg"
      4⤵
      PID:7788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-47dvci.sb10r.jpg" "
    3⤵
    PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-47dvci.sb10r.jpg"
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4048 --field-trial-handle=1824,i,9140946775585584166,15380800066523090624,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    PID:7996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-rfa31p.l3jq9.jpg" "
    3⤵
    PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-rfa31p.l3jq9.jpg"
      4⤵
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uw4m8v.bv2.jpg" "
    3⤵
    PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1uw4m8v.bv2.jpg"
      4⤵
      PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1g78mit.p49u.jpg" "
    3⤵
    PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1g78mit.p49u.jpg"
      4⤵
      PID:7720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-g1hq0a.t0vrc.jpg" "
    3⤵
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-g1hq0a.t0vrc.jpg"
      4⤵
      PID:7760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1nbjlt.0rdf8.jpg" "
    3⤵
    PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1nbjlt.0rdf8.jpg"
      4⤵
      PID:6148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-12nuh67.xnxr.jpg" "
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-12nuh67.xnxr.jpg"
      4⤵
      PID:6300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ck1hs4.b8f5.jpg" "
    3⤵
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ck1hs4.b8f5.jpg"
      4⤵
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18l5cei.smdr.jpg" "
    3⤵
    PID:748
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18l5cei.smdr.jpg"
      4⤵
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1cfj4n7.hlzx.jpg" "
    3⤵
    PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1cfj4n7.hlzx.jpg"
      4⤵
      PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-seh2vl.rli2n.jpg" "
    3⤵
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-seh2vl.rli2n.jpg"
      4⤵
      PID:6464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8eil66.7564q.jpg" "
    3⤵
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8eil66.7564q.jpg"
      4⤵
      PID:7640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18ag4fl.f6nm.jpg" "
    3⤵
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-18ag4fl.f6nm.jpg"
      4⤵
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1xgufg9.9ex8.jpg" "
    3⤵
    PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1xgufg9.9ex8.jpg"
      4⤵
      PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1fy8hby.zi5d.jpg" "
    3⤵
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1fy8hby.zi5d.jpg"
      4⤵
      PID:2544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1x2ukxg.6fonh.jpg" "
    3⤵
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1x2ukxg.6fonh.jpg"
      4⤵
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vqgu3o.c5vto.jpg" "
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-vqgu3o.c5vto.jpg"
      4⤵
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bd2vk5.ruqbc.jpg" "
    3⤵
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bd2vk5.ruqbc.jpg"
      4⤵
      PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1wr9ra3.pcsu.jpg" "
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1wr9ra3.pcsu.jpg"
      4⤵
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8u8xhe.spb8u.jpg" "
    3⤵
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8u8xhe.spb8u.jpg"
      4⤵
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-d25w27.10czk.jpg" "
    3⤵
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-d25w27.10czk.jpg"
      4⤵
      PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-14ouxxh.u5mu.jpg" "
    3⤵
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-14ouxxh.u5mu.jpg"
      4⤵
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5w12un.ed5z6.jpg" "
    3⤵
    PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5w12un.ed5z6.jpg"
      4⤵
      PID:7108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6vqf23.oz3vv.jpg" "
    3⤵
    PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6vqf23.oz3vv.jpg"
      4⤵
      PID:6352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3ql0jm.3y299.jpg" "
    3⤵
    PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3ql0jm.3y299.jpg"
      4⤵
      PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lxgrzq.h7r4b.jpg" "
    3⤵
    PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-lxgrzq.h7r4b.jpg"
      4⤵
      PID:7764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3xxiu1.jlmin.jpg" "
    3⤵
    PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-3xxiu1.jlmin.jpg"
      4⤵
      PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1q2l7we.2zbm.jpg" "
    3⤵
    PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1q2l7we.2zbm.jpg"
      4⤵
      PID:7992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8rkmfx.5oze.jpg" "
    3⤵
    PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-8rkmfx.5oze.jpg"
      4⤵
      PID:7972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-rlonrb.pid77.jpg" "
    3⤵
    PID:5916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-rlonrb.pid77.jpg"
      4⤵
      PID:7196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1kaject.3np4i.jpg" "
    3⤵
    PID:3532
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1kaject.3np4i.jpg"
      4⤵
      PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ss94ea.t65xg.jpg" "
    3⤵
    PID:2336
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1ss94ea.t65xg.jpg"
      4⤵
      PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-eh8ls5.7q26g.jpg" "
    3⤵
    PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-eh8ls5.7q26g.jpg"
      4⤵
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1qedhso.0lmx.jpg" "
    3⤵
    PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1qedhso.0lmx.jpg"
      4⤵
      PID:7268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16hvgyk.rzjr.jpg" "
    3⤵
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-16hvgyk.rzjr.jpg"
      4⤵
      PID:7540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-15mt6g0.ihtw.jpg" "
    3⤵
    PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-15mt6g0.ihtw.jpg"
      4⤵
      PID:6524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1tteked.4r56.jpg" "
    3⤵
    PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1tteked.4r56.jpg"
      4⤵
      PID:8152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bxszoh.hmlgf.jpg" "
    3⤵
    PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-bxszoh.hmlgf.jpg"
      4⤵
      PID:7244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5b8q7f.6lozg.jpg" "
    3⤵
    PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-5b8q7f.6lozg.jpg"
      4⤵
      PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ysdi17.iwngj.jpg" "
    3⤵
    PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-ysdi17.iwngj.jpg"
      4⤵
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1vtaotx.a0zi.jpg" "
    3⤵
    PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-1vtaotx.a0zi.jpg"
      4⤵
      PID:7720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6gee65.iqto.jpg" "
    3⤵
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-6gee65.iqto.jpg"
      4⤵
      PID:7820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024219-1252-10qj7p5.drep.jpg" "
    3⤵
    PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024219-1252-10qj7p5.drep.jpg"
      4⤵
      PID:6672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024219-1252-8nb6m1.4clqi.jpg

Filesize
67KB

MD5
b648df3ab31df81981627e56c2da27cb

SHA1
8b3497f380a76db5c814d6bdef2eef60a97d4e3b

SHA256
1824bcb3e920c28b6c8699cb2aa3e7c83e00fbcbaf407293342f548027ca533e

SHA512
bc8032ef1ab97de252a6bb452a74ffef8a21be0bab986c2c0f30f2ff69c5103f21f935164f41c4e511cdc485497d4bbf44020c6705298ab847ae8f242f863ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\D3DCompiler_47.dll

Filesize
128KB

MD5
e0f49e88892d3a83211f597815b24020

SHA1
b16841ca257fbe9ca80a0e4ead0bc5e4561aeec9

SHA256
c84bf222a4016ba0c7d31b179f04576211323a2cfaef5afeedeb82eb7a6db8dd

SHA512
5220be23f9032c1d3d9d8771c4c7afa4e0a735a0744bee3c03f453f281f05a5d750f33dd62b6bb81a985809fb9949249fef376fccb6d4a06a747da825a4938e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe

Filesize
202KB

MD5
3912e385ad4dc29302b4a27bdcff0a50

SHA1
45fe4c86589b7e76cf312b02f43aeb35cca485ac

SHA256
d3f2a0ad9e587d7ceb62cf14a9f6e3c52be80ab7cc87ec3d10eadd8b4e587149

SHA512
ef8492d66721861adaa45dde8a25dfeb5815251da98e7d4df7744fa84f1efb3d01a5946e43635f7d002fbdaa9fa2c9eeb27691f76533a7baf5d16a68256be5e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe

Filesize
23KB

MD5
69f26f9bc108fd28bda7295fc85bf8c9

SHA1
bd7d869d3791454a96a841b2dea6cf368fd35d3e

SHA256
e61f618a7f55b8f6ed2781524169ea3b7afe09942d2d720dbe99ef3fc5b6ff5e

SHA512
f15d5cfa642883e8b2439c921d432b408d1362da0a9f76307da698a5afd77ba695b9d57ea4e5fbd8eebb465720d30de6afdebaf81f905f4099abb2c89635ddcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe

Filesize
192KB

MD5
674dc78a56ec16db7affbfea31917b2a

SHA1
ec1f3c2c9b6c666eed2b01e13655968e38df7ca2

SHA256
fdf313a5bf0f484fd2907f814b6f3f80c6ab193fcbc01d7b579766b2d451c15e

SHA512
f75f17cbb8b3b0d5941486dfdb5954fa568437d6033d6973ad899457c2200a8862d5c896d1f0a95824c93a96b893c11b847cac434d8f226f7f6ae14f9d7ccc50

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\Launcher.exe

Filesize
231KB

MD5
088a9e9115e83b3946cb8fcfa4b448d1

SHA1
4e6ebcd8f88cacec2fc99020b10dcd4aaf430050

SHA256
2132b643f6a81f424ffe403728b55a7d50083e0b2d9a441478c8e1efd624eba2

SHA512
70e5069d58d7551c09c6de9e41b0364f8169c8e1f632c5d85e4f15ccea0e91ca2608b4864c8d8f29b69f960cfcd5c7fe9454912ca5ef9a0da99b1af7583192de

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\chrome_100_percent.pak

Filesize
163KB

MD5
4fc6564b727baa5fecf6bf3f6116cc64

SHA1
6ced7b16dc1abe862820dfe25f4fe7ead1d3f518

SHA256
b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb

SHA512
fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\chrome_100_percent.pak

Filesize
97KB

MD5
ba31fd3303f06e69fc26df7f7f77ee87

SHA1
ee7853b63b9e94952377ee61a7610b519ff1374a

SHA256
ba1261f7949280b8eef3d2e549bc30488acd068e5e7b2dc15384380130259295

SHA512
eda7c72de73d312dd2ad8ba56ee3d5a5bd407f8576ec0bb8c8742918e92d99db643b448b208834303696752007dffe4e69cd978165194e128bfe3b682ca6ea07

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\chrome_200_percent.pak

Filesize
84KB

MD5
62146728b0a197578fc67f41c1ea78b2

SHA1
8e0804c00d606d4262191d19c2b563f34fcd8188

SHA256
768a0430a2438f8ff17061f54ff47cee240f5fc83d60c4456a2158405a5688da

SHA512
c6082c2c12cf023a02647cc345223f8f0f25916258ebf8e7a003cbd33a47041322d860b4ccc2e185c166b4b27396647ea9fc41b721009b6d22f9e25a4e4decc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\ffmpeg.dll

Filesize
234KB

MD5
5d30d9ddd18028bad9eda48e02738d09

SHA1
c9fa280c59ff9ce1d23fd87e8e3fe4589a38a18e

SHA256
87dbfc34526c7d0f9feea3af67386c3d8c152f2305bd2a47d0670878fec4efa8

SHA512
77a734031b7de6af8d4cebebad6c16fa43cbfc33233b6e28af3f47286bb4ab1edef9d0a55998adc280171538d9437e798376f211bee626aeac4ae3f42dc87a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\icudtl.dat

Filesize
230KB

MD5
b4442b4d094c58f5aafc8951ed692778

SHA1
184f4cf5ba6047b54e5923501617b969ad685c25

SHA256
5a5482892f221eb967d7273b9a86ee318f7605ec96a0593caf5cd9534d27dd60

SHA512
634eba53eac7c1f919a54afc113f58d1a8cc26035058e5a7b731c1db35aee7deccb323f2aa09930ed1594338c4d31f75770e4dc77b9095701ba053371dac7d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\libegl.dll

Filesize
256KB

MD5
13f5df7e4d22d3f47e5b08844e6e6968

SHA1
cecb3d234e7105ff49e953d009c6efee46dd5720

SHA256
36973e45a53e74811e84987eb9f36831b29fcc03ea0a153ae08abd10c893b978

SHA512
f370d080315915bd76fb921ba567b3e2fbf65b68538677f2a6a85f5e9c70d9c0ad32b905add04c1ba05aebbcd67711c588bfa02acd04e96d4be57f4ed8ceda01

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\libglesv2.dll

Filesize
320KB

MD5
413a02cc52bfd844d29b4402975c8cc8

SHA1
347a8776e8ef2403ea10c2e0e9bcb6b8f43238a2

SHA256
270c5b0903cffb91cf15d6ce40ae186a33226e4a63f73220393ab4d1c8ef399c

SHA512
3e51f22d2de8acdc8ce8f05fc6f410f302236b7c1417b004031748682615d4c2624c0d8108a3c08395e311b3983acd660325d2227d0d98fdfe721893861874b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\locales\en-US.pak

Filesize
69KB

MD5
d4d0a4c73443810490802fcfc76fc625

SHA1
defc8f325c1b1b87c64e0691cfb8bb4e95bf2d0b

SHA256
e0107760269c172464172efb4dfe5d4685174c146ca48493699bcf0b6e1d64a3

SHA512
5a9c0b84a316c73534e581dd40f30f020b718e93d82ff68687ec98f0e133e6a6b891aa25f246d7716a8f66a288996f4e34db0af0be54115d7e1d1c0b711747d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\resources.pak

Filesize
69KB

MD5
ea0906fe9f8e669e6dfdef9ead001897

SHA1
f358bbd5c71b0455efe819c6b99275eea22ba7d3

SHA256
b91a4c7ccdf5c980d0f7df5db0496d3b73f5950b0d2cbf0f4e3b7aff3b98cb13

SHA512
c8bb41d758c26ffc15077f10737db9531f22555c9995ec6669b79f44cc59764e1871aa4579ff6fcd9512d73708e7a3db2aa84772f4e637a69db61f86f2b606f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\resources\app.asar

Filesize
195KB

MD5
329a276fb275af3ff31f8abc5797b55e

SHA1
d41338e50cda7d5cf74f20eea70d88bebc7712d6

SHA256
ab5a736504df38261032930f04f4cfd511480874ce694eddb2dde9c558f3e007

SHA512
1dd4a8a85e1e0983fa89bfbd5f98a2069073e6eaa032dcd58f059e5722962a117b48ab69eac9a3b2d8bc90ab9e9db6e743a90b5e414fc1ccc5914b72ee7a34d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\v8_context_snapshot.bin

Filesize
217KB

MD5
ec6ba562c402f99f94b057fd30baa1f5

SHA1
d7aa068da6d9ab7e203b6bc69f30e2a4f87c5051

SHA256
e1d07e08140e502c159041e2268b03dc51af7d5f9f31603eff5711cf8ca1889a

SHA512
981bd50e81c9b3c97eb6cfbb3f403736cc7143f2f213510611daf2fee9f112d8f25ed55f940b846f80c021a1f67513f86adfc55eaf4c6cb72f1857f1e3384db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\vk_swiftshader.dll

Filesize
473KB

MD5
80da472e9fdd24c22a4ff2ccca9e77e4

SHA1
a1aaad8ba39f716a70e908c455136101598cff75

SHA256
0d192abe4a7d5f4def5dc4a43a3b54b23672d23a6d4d3b61c2835ade3cd4e739

SHA512
2fa6069cd59897966c53c2d3fbce32d14007b4b8b2eddc407c266b96fd2f64c16186e83300d38dc25fd92be67730b6258cb76ab4f0d97469a778fcb8a3aff44d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA6F9.tmp

Filesize
1KB

MD5
aee1feb39ee69b3abde5f41cd3cab82c

SHA1
a02362b9d4df15be7d8d71e3543d4c593eca132d

SHA256
3dab132f34200132ef13ce6edfa141960559fcb072eaf3303d8d6ef954e52a7f

SHA512
e98a58a679b0adde89d1f15247873a174dad122ac2d07326f45745fa8244b994ee587419b445a3ff3bd63345d64722e69b527d2506ff8d9fc8d6a5177afc9d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA709.tmp

Filesize
1KB

MD5
5503a452f97e425308216eab5228e1b3

SHA1
5457d7012cf70880046d6bbcc14419b38445bbea

SHA256
f12b1fbb8399fb2d96055531cb5b3dab7773de1761c3ba11ef22a8aa11861e59

SHA512
be017c45d10ebcc6bd1e6f450360093b1865f78d7b283e0967fccf7500d9866e019064a26ef55b4dba35fb2825bb30b7658b0074777377553ec270cfeb46832e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA728.tmp

Filesize
1KB

MD5
a136f2f3a100aa26e734fdd3041d5568

SHA1
e9106ecbd8d8391684311789e0d2c430cad46bd0

SHA256
15c18ac7b391e6f0cc6d5b00195aa41d29825f8edf67ae431611e90372f95ead

SHA512
70d410bfe71ed48be0f07f4c6b0def6b5f57cf233b52ccd70212fbed421ccc278c4cb059e863791ac8098c9aa2089c896357664ff23a3447b7f684776ceb193f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA757.tmp

Filesize
1KB

MD5
edc6c2fefe4ae2fa1cf10425283a8a4b

SHA1
b107793c9cb035ef035c9b27e7e0d70376178246

SHA256
f7ed1f14c95139017447fef989c56304b0e5a3cad1b24400c905e08e621c1662

SHA512
33920f213451b96748a80c88f6f15da6d85c65d66bd33704538814de249d9b2a96e881241b85559c2cfb926af6f069a753d1295b1051a1421875282ffb2793cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA758.tmp

Filesize
1KB

MD5
836d5394ad9c5cd00cbbe9c6da7db55b

SHA1
3186ed5115afbcc51548b10a7dddfa05db107c11

SHA256
3d65ab3e15d08dbcefc7e55b483dca510709dee614395299b8357fa2874a4730

SHA512
7732185774f986e8b2d0ab927483c6ed3827236f2d3029d2a1f5af505271c10371260bd5772314e696508f8113df65bb331966abdc2983fe5b7405261849b76f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA766.tmp

Filesize
1KB

MD5
79ce570471ef8037298eed67f8f09217

SHA1
e67b673012bf217c306404b0d113c4ee25c31df8

SHA256
5bffd240738356544b59f46d12717eebe6b48d70509415d0cbe70302b567d95e

SHA512
a22f0f726c92d83401149af52dbd7fffec4846beacb6f28d639e1eb7aea57aaf576f4acf986c1d670b063e8c206be796c02f1ce2408033c877db2a6cb8951bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA851.tmp

Filesize
1KB

MD5
ced36950b71e3e0143a3b97868833386

SHA1
4a85019ad750bba9a95d44dc7f00b1fb548387d3

SHA256
c3f86b4ea3f4e6676dff9252b9716fe5577b9419e331d10cf86e0f9767fa4297

SHA512
0dd7eec88e0b4a16465652b49cf7bc52fa86e5aaf90672812d0555ef50fafd768b867bcf4f65089db35694f34581b0a2f598f6ac7484ffa98e2a58f7281634ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA860.tmp

Filesize
1KB

MD5
1b7e5989381ff63f9fc2432b52bd606f

SHA1
ba37721d307f278088dbc6473a08cef76c64bee9

SHA256
b3c45545a26254eb04666c337693263a112232862dfee63887b9892d66d80868

SHA512
291658edac94340bdf1fb9abfb76eb523d2611471f9b8eaa4b333c1931a798ffcbfdb6b01fa94a759bc55fb5ba5c79e42cc09f0d8a9d4ba19cc0d182a7e04962

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

Filesize
249B

MD5
cf7e4a12f932a3fddddacc8b10e1f1b0

SHA1
db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

SHA256
1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

SHA512
fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\LICENSES.chromium.html

Filesize
510KB

MD5
3168ff83afec2774fe3e2ecf9dab02a0

SHA1
b8d56710c22c31bae2f55b8feb1c8ec6331e96a8

SHA256
6779f39a47f2fcb105bf1c5104b8e7af23994c6b5dd5964166f1ef9821a4f614

SHA512
5a7c12fb45ffbe212ccfe6cc55a8e363133062786dff12e2eb4839ef83a148e0e84b6891defc10f354fc321b443051b5bd9d273e12f11d8ef46a85f32336c7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\Launcher.exe

Filesize
403KB

MD5
892b9df8caee07e3a7f25b6ff22726bb

SHA1
bc0286abb0779c5905f4936a413e8a160047e91a

SHA256
5c599a95b396dad1ca58851d3ff154bba8f7a86d04bb5e3a9dae246fe46271d9

SHA512
7a8ee07c0872f255d2c221e64db13ca7857b38ff0d252a5afabf607269c7d5845ce858c5c27280290e9e5dc451513fccf73fbd410098d180206901000168143d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\chrome_200_percent.pak

Filesize
222KB

MD5
47668ac5038e68a565e0a9243df3c9e5

SHA1
38408f73501162d96757a72c63e41e78541c8e8e

SHA256
fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32

SHA512
5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\d3dcompiler_47.dll

Filesize
1.5MB

MD5
09e8cbb32200764b439dcf4af8a3c817

SHA1
54fcf990515e280812ccd26263b98686d04c4ff0

SHA256
7b42dd1ba4b8f037fbf042e9e3adcd4650f98d0f7da2e204532dec1de58ba570

SHA512
4b7053703fbdaf4eb180a99c4098911164d1c8c684ae01580e5be1d5744a96b0acdda273d0917d0bb84f5000369a5743e4f3b08399e0f16d32c05db239a42619

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\ffmpeg.dll

Filesize
1.6MB

MD5
60db0d449d43e2c17e5ee7342ada984f

SHA1
8e2132f043f06959dcc740dc91d6d237b355dada

SHA256
e92432f832efcb7f93c204e013578e7f6da5b1846f7be32bbb4c5fad70735f96

SHA512
fdd85d4c071cc684bb7b029808f1bf8836f408799c25a01e0609e49d9c71275f7170d1966bf812696c3ffdae50fd90172dc5cda658551cca6c744f31e694fbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\icudtl.dat

Filesize
2.1MB

MD5
c6a8f88ab7b32c4b0b9827b3c2f3aca9

SHA1
068b6172adf18ca558cc6f8c48e27f11fc97f37d

SHA256
e95cda2a61d8775d81222f4b554050469deef2b5497396781a8815d5ecb9667f

SHA512
6eaa3287c854dfa958ce54f646a75fa2acb72f81d4a8d0560e08991b5976e056580f481b5231c619f471eafe5b2c7ff93745d8fdf717eff26c047b172897032e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\libEGL.dll

Filesize
377KB

MD5
242b496a61b460e2b4c3c7004bf7eb56

SHA1
69c492e5a9668a0572b2cc4affcabf7c90bee035

SHA256
38a30a5d52b8a65c3901189f4e4c8f3de70914946fc1d31c6093825d7b245c98

SHA512
f97c9ae825d97ad98e652d697d704cd35e6d21c4527a8fa63b28abac9bb6de719db006a65ff543a59b9f22f6225a2a4084a9e645739778e481fb29c4d08eb817

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\libGLESv2.dll

Filesize
531KB

MD5
cbfda0a474855ae5e03a910accfb2d5d

SHA1
ffec9824172e8c8b0c0fa6a1d6a563fa6e69500b

SHA256
f1cbeda82d7abd80c4b1656a89f54292d281e1164cfe108b4deb6ddbf9aed66a

SHA512
add1a4075bc12942370ffad731ff713a99df6392c33b4810849dd82451986b77fee254fdbfbb173916ac860077753350e611ba54ce4c6f32f80974c0f9ffe61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\af.pak

Filesize
103KB

MD5
9d81f7b719d5994c5eee555dbe22a8e8

SHA1
b4720e2ee365a3f688b151d1c035c3a07b04c468

SHA256
a79a692eeacaa13534701b4faa435c76775101090cb50f96b8bbf3b27159b2fb

SHA512
ec458a2fcee808a749a73d2ea1f17d661f6e4f186af6e0416f4fe1383f2818592dd9f4e0769d7be7d9923dab50f854072a3c73daadd18f2afc53bc5e2766ee4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\am.pak

Filesize
192KB

MD5
702c17653cbedebfdb296c660c4f83ad

SHA1
ff1406ec984f26ead2beedebb132ebc55d40949c

SHA256
3eefa89b72d5cc49bbcc182246e68087ee54211baba2ae4f7e2c10ec3e169854

SHA512
180c11faa41b89f110ceba4c3df9f5e1e7470dfcb2865d15cdbf4acea92b65836e795fe4f6f995103c99c983dfa4d4667ebda2553654aa29cc3f134b1c41f8d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ar.pak

Filesize
126KB

MD5
1f53dbe146de66b823ea843f5e66a5b2

SHA1
e93eff56b5318548b3cd81fefec34cb7f4dd735a

SHA256
fb875ba2390de43b49825f33f252293145ad47f3d4da3a58f3671a00a8df5e8f

SHA512
1830b2191b8114b9ad9187dd8ca21089afe8fd9cb0b66ce32d7038575f5c03f9f92b42cd7ee125f61626e24423f1ced5a7b4e3d010694922fb37ea80310d1f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\bg.pak

Filesize
247KB

MD5
452ce3041c88e9d3d3a18c7b03168404

SHA1
7c84ccc59d3636aa744cd3166bec4347ffc82070

SHA256
ea656c7ac6725cd9aa2d5763bfbe0bc32ebe0119221b9c57caff3ca548a51b1a

SHA512
c376d1a6fe2a29e343f0e58687299c5d3f31d308141860c7349a804cc8d0c8100930e32b2c29bd77d844c630cde399a403a76bfa2ce48913ac1cf194497aa1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\bn.pak

Filesize
363KB

MD5
be631329cd41b12791401629c6044378

SHA1
5a9ce533a17e82b8e94e88e284bfa7abca9df15e

SHA256
a235dc41b74052ac6b767dc72cc67c2c1a98da0c6c09a43b99ae47d441ef762b

SHA512
dc94727c10aa9336205f80856b77c591eb8134db33acefcefcfc7f8089f7f997b73f2ab39d227a2c7230f05408103a8624f715cdbfb948c644dc06ea031defab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ca.pak

Filesize
185KB

MD5
c75bdd987a4a954fd7fc027845393929

SHA1
edb7035c3ef1840afba3584da7df6810c3ad0897

SHA256
ff8574c7e54410b0a00db6c6c878789c9f14a0c7fe5358f24ca30a187dbf73a6

SHA512
01257b6d2918c5b60048893733b7b5a3ed3e78848ed1ecb19ce2e9a9290130dec74f2d7de44f128deac28fe33128002583645a8ac2d9cf711138e402e2cb0646

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\cs.pak

Filesize
229KB

MD5
d9b0bca666b0ca98ca6fdddb89ae3a6f

SHA1
6a95343e818b421cdc4e97bd1a454ab3f4fe82ed

SHA256
b4b88c40932de8846aeb78d8105236b42e32609ad9fcd698bb345fc824bb57e0

SHA512
4a4681a88c8c5bf4797ff9bec9d1aef755d8eac1f8855f76fec6200d427a2fa69472aae6fd7a87cd826976dcb7814bdee7b43566640891d15647a81b912f77b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\da.pak

Filesize
83KB

MD5
9c4b9bc0366b4aff972bdea25d2c502a

SHA1
8971d4ca860621f624709cac860df8434e0cd602

SHA256
92a434c1a3f1d4ba2617f19a2f434418f5d1641b34d0b42e513474b831f09cda

SHA512
d2e964f0a3b6256d8873ecbd9d6184d4604b3c74d93928655b236f1d3cfc864d76d490e833bbf1a5a3e204c84a90ef7d6bbf3c860291c4784102be07a0aff11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\de.pak

Filesize
34KB

MD5
2915c8df55a8ac59bbf7a2d1435f1ee7

SHA1
3f36ef2ee29732aa7d6bd314545afbadf9a46398

SHA256
61f665b371ceb7b040ff10e8da2558c28be6284306e22f53797eeb6195ebdacd

SHA512
16cbdfd1891b226a44400577825bf34a209b5810e79366066dd53eef97cd6f43fd8c26d14a5f7b3b2df7fd94040199654d45080229a871ca3ca4b4eecceabdf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\el.pak

Filesize
9KB

MD5
0d8577b43a803ffcd4c6f9f514b5a08b

SHA1
42c33d89c5e1e9d4b54dff263dd5918bce47b589

SHA256
3a5e5dab2b3aa79e8c50018168291c653e6664cc4dcbc4e28d30ec8000117890

SHA512
e9f5904f335cf8a22f2bd4e82d5f83f1b053b6dab5293beeac77452f86cae32ab04843919c6f14bfae872d3d8dc9297ad82a69685af16775fe855145a47c6dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\en-GB.pak

Filesize
7KB

MD5
ecc7b577fd310d647239a7fff5de4724

SHA1
df90ba548e4f7232d97f4b977eecb6dc67d89639

SHA256
fa5ce406bc84ce5855af90459000725d335f9237672e183ee76bd4df94f68e8b

SHA512
b78d3ec93684203a274f8df1e22e4a2ae2f4b5240244e7d4a46168033bcd264b21e88111020a88a8b81f15eae59710d6720188976fb793e1376935cc45cb425f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\en-US.pak

Filesize
109KB

MD5
a74fa4746f953a7b0af61deb00a5fe3b

SHA1
453a19c57f26016756518152b31e3a2b916f735d

SHA256
aaed8d5b74b1a864a7fef6e050de24c55eb11117ea62dc7c35c6d0291a82289b

SHA512
39102882ed6a327f5c67991659ae18615a5e364689602109633a65ee165128fcd2c6d6d4857720716d33cd6b09d38287b33490a718321aedf83a4f53fcbd9ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\es-419.pak

Filesize
1KB

MD5
62a042e55754ba98db9ffc62e944c53a

SHA1
2aeb5cff128b13b4fe6c8889f38513b47f9b4ed7

SHA256
8d844a1ca9c6852709269e58a8dd281f4fca7beb8a294079dccd36c7db3f73b2

SHA512
cc9fffcb713839d4c6e3cfe131e8c67991a71fe587fbea247fbdee24267eb669c3eecce436945b51cbe842e6b2418871a58334a6b8c830cefed5e317d84afd54

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\es.pak

Filesize
57KB

MD5
1ba495b80fa8f1bd4c1c048b3817a008

SHA1
a0d7283c25df37f95628761578020e1462700617

SHA256
fe680823cb2bdc0dc3ac065ad991a261fae2a9566ddc2faabe081eeab736dfd1

SHA512
9cf4c1a88441c25365a10f72ec506d851240eabfe1f4f54a92e681bc5e541e9cb53cc61820bc2bbd07e0efbfb87358c8b237fe55347b7b83cff463d177c42e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\et.pak

Filesize
15KB

MD5
e41fca51416a77a4018893172611e66c

SHA1
8a50f6d2500880d40fbc355805385cb61b44d198

SHA256
52a590da747ceaf5cf9f72ca9644738458c00aeb217fa66d75c02085e26978f0

SHA512
a21f3c7e2e6b295ddc4eaed51e151c6574c3bf4f31f6ed702e93e2efea970aa74949e49583389e10ce4f3de0e55659f4288f21769bab85a0964ae200ee0686ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\fa.pak

Filesize
98KB

MD5
ad6129e50ce6a3813a67e13a99f49931

SHA1
a4264d18545edac694de0998a3b0d6f82c4ac6b4

SHA256
382de94c3f5bf3529bce3a53f54b4238eb56f5d6a8c916d7acc139fc69f5a066

SHA512
c7be8eef05723c3799dffd085a3636c51f38fdbd8ea7b5aec489c76bfa6fdb8be056529b35e83efbe3c41084f076c15767aa3797605b5b6d5fd245d96f2fa71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\fi.pak

Filesize
51KB

MD5
ccb55ef021f200f496b2666a5672957e

SHA1
9f85fe1d3d44eaf2443abbec3b1f8ebec1847845

SHA256
98386af34576dd3464783817ed242bba1d9076101743fd89a664c0b33e7349fb

SHA512
e0adff48b45e5bf3460d2765275f066e4d44cb777ad32abab87a4f450a24a003bcf42a8c807b06474c327914b45abf416a473a169707efda56d0f8e4aac36a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\fil.pak

Filesize
10KB

MD5
5a1092ff347f2d5a353f2bf785edf616

SHA1
f1690a4669d36ca08815aa6b5f21957353a88dab

SHA256
112cc5f9849efc817a4873fae3c88d787473c2f57731133b8e3f2a22a98955f1

SHA512
7c9e0e087e9e119a1ed6064ee2dcf2ad7af54e8538a9eab58bae0cd6969aaa51bfd995aef18951c86b4627d5507175e78066bed6996673e20a1ad24de2a5d500

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\fr.pak

Filesize
12KB

MD5
82474b117378eaaa409d0d06883d0f6d

SHA1
a8c1c02c5f68a1ae8781c95e2a810c66150325c8

SHA256
1ce0d043881831f7bb5f171ee48903e9a6f90b01e0272b9584a8618d0d6c8ad4

SHA512
3ff65c3df8c65c5c777aae5abcdc0ee53545438714966fe856baa4a06d204c44601d2d25d0f58f672c774d618284d8d2edd2d799462c6f776b45c66064fdac16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\gu.pak

Filesize
54KB

MD5
05d4dc94d598454fe5fa142705596a85

SHA1
80a6dd7616d287ae59d243c129b5381bab277a28

SHA256
1aee27a9f105b55e92bff35402373a61f5c3b8882a2612e3e7fc3fc568230e0f

SHA512
072da5308768b1f38715a41172b567841c39f669478918629ca14b7c535f9b7826cae7a97f8b3f86d2e54ba64d1f31c589f5cbe4ad7c976dfdc5447f14aa986d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\he.pak

Filesize
233KB

MD5
f0ee77e4ec64725dd4c5a9825eab82af

SHA1
db3b8722c8164bd233ac10e38e968bb0fdfd906a

SHA256
a32a4bd47421a9573a71f2187623a7c18a05ce03a53e4de6a9d1aaec67f2b3f9

SHA512
4bd0640edf0fb6b1c5997d4bfb4a93671c2266900268aa8c7ba08cb7ed0bb44244f6f32c622a5ffcd1f25271ba388a7beff77f6cef7539743bf039aea6c443e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\hi.pak

Filesize
333KB

MD5
7e1de46eb2f61a4ba2ec37da90ba583b

SHA1
6eab4654e4e5dad3a1e736cbeb83c479afabb4f4

SHA256
8dee2ee5858eb40c9d6a5ba72fb6cea05964bc0b7cbe3b9f72f43ec1d44f422e

SHA512
26eed779d3861d74f997f8a9a535d694d5217f91076ddd36425b85ccf8241c46ac87280f2c91801b5240e853d8a49edec5919a1667d9dec0bdc8111480ed5175

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\hr.pak

Filesize
124KB

MD5
6eb2ff2fd8e23b9d5b1c85a4fa5489eb

SHA1
41ec83e9e502ea1e98c67e188d5c43f2ae01b5fb

SHA256
545ab2b896a8b584c1a35d7c968f0153370118d54ae49d0fbdfd1a1dcbd41dc7

SHA512
da67d541071820a4bcf8a683cc8c6f52da53b9d208b373394efa3cf8a19ffbe57202cba99834566c21adee2fa3b64601a3c8f06a931422a7e54dedb184285c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\hu.pak

Filesize
378KB

MD5
8291dcbe82a84e16b7a2fbad9615312a

SHA1
03fad8edb88a168f866921656c8beb6143e00aaf

SHA256
aa90c16316b82327d640268e53ec8c99b74a8daaab63b361eead1bafa7716764

SHA512
f3586f8798379f5b591ed64221442f2e152256440e0b3331d11acb58abcd6f8b8823b139f4b81fa2c879ffca4ef0de51bccde7fa80f0aa8ae0fcffea8a6f2d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\id.pak

Filesize
235KB

MD5
ac196eb2a4930b7f299358d5f3be0fec

SHA1
ae8d3e9183a7d5e7a46fc2d2a74e2912a34340ed

SHA256
b939d89f9c81dd6b0277fe395e6b3b989be8851047b037dc4a980a5d0d5d8cc6

SHA512
f115cd8f30295077ff59e60840f95cfe136c4e139ec101c3d002b30ee490d3e21bca340bc33725b7f66e44bff545521a70afda1a6f934fa73c0986be3b953e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\it.pak

Filesize
188KB

MD5
e7fed60be0cf97f4cb33aa061c9e3dad

SHA1
22562b377c2e22ae43f7754d3850c27fff76583a

SHA256
c76c26e02c6f7d0062f31803b7ede35a2f21f69c3214007b96edc8d8e617689e

SHA512
175e582f07997564ae0f1fd75f6bb50f31dce0be4381cc8c432d33bb9ab363d0e51819c15842a92c7aa31549c177fd6bbd18d563bc6f9c629fffa470da18d629

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ja.pak

Filesize
238KB

MD5
3a81edd33b067d03e342835c034f08f7

SHA1
8395bb9a2fbca48503ce2bafe84b4c73a67ab055

SHA256
dc1a6b528c1d13312bed4cf3fa6bf1cf2aedb4108c9b0f969afbcb9fd4d74839

SHA512
e994dad80ceb11f6d1eb859be5b7d0de672573d96c046de3bea4e243ba2623e6999864ec0ab32d737e09567da34c9927bbc903d38f72491d3a3bc82e162bd925

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\kn.pak

Filesize
258KB

MD5
9ed38635f9a62cb78558bee1dafc8978

SHA1
341902bd3d052676167af8ae06af8eee4b8941f0

SHA256
f975d5d1aaf6f42fff90cf24859c60da9b8a1ed8c27c2c649d0c756f29903ffb

SHA512
f9098c8b4ee00bd068c1e03110ed256043b99e1495cfd8b49452c2a7e585f3ba4b1455e40a3dc33c3d39ced41ec7209ae79b231b37f28c2f2d112a01433b48e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ko.pak

Filesize
272KB

MD5
f5fc9e453341b04afd20850de56365f3

SHA1
8f996a163d5d27f80019b43e4261037bdd00b7c5

SHA256
d4bef19fefd2047c07fa750f6c6d30531801f5ae89c1230f67782fb7f6bbc121

SHA512
ab444e276f4a5cf15482c4a9aa1d8030ebcc4d5aa405dbe6970c0ed4ea9eb8e0de11c49689a5a27f885bf33079dd5477e1318af3d6dcf0bbb80b5bd63ae88f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\lt.pak

Filesize
170KB

MD5
0de69b67253c1e5ee88723ded0d45f66

SHA1
58d9c38626f88ae9e6e229d18b961dd5be532815

SHA256
cebd676773915e3c664d20f6d3e617a3c6f0f50a1a8908e633644a94c4118eee

SHA512
81bcbef5f292a3a111e1c4ddbd2731f373bc67174d571540d38e96eca581032f35f183d0ab23a3c1246b2b435a62dc6f795ffd5f69ccec9c2d9e6d2eb349913e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\lv.pak

Filesize
236KB

MD5
09a8da5a31550b40fcfcc579ad6bf88e

SHA1
9d69c2bda9b3408808194336f3b1ebef1222284d

SHA256
274427bf041b501a5d1fff18040c3c009c1c327c8ffe676b0d9441602db730d7

SHA512
02f596ba7c3c987ec7a7d71ef3fe77c2c16493f22484ceb967bb5fde6be37ae937ccaa632b9e475bf2beb826071a926e0ea42bb1a7ff02d26dd3defeacbd0ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ml.pak

Filesize
104KB

MD5
b5ddb2ccfd979d99cf8b82ad0676303d

SHA1
294e2867229372517370cf8d0d60700a8908a2f0

SHA256
f3806ea87dd3515cb6f365120793d2b01b890b3451fc2611dfe7cb7a9b1b94d1

SHA512
50a328abe81cf6d56fdff16a1f0817c39f61d7218e0fda98247137c0265fd11dde93b306c8e89847a8f77e9c7405bcdbe4f3787e3dd2347eef3200abd5fa3c11

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\mr.pak

Filesize
266KB

MD5
1e46877e50b403e6d8c81b2d74fe91ef

SHA1
ce84c99750c251f86c37e9efc71fcaf7f2d883a5

SHA256
d6cd2aab719d6d920e31c6f5dd7f84a083cddd2f152f9dd67cd8ab34f8d8f4df

SHA512
bc18df383394c2af2c9ad4509756fc5b907b1e42b8fd0b2726a5b91c285be0da7044632028e6de6970155c4c89dd2e48069807755e3a4a5a934f553fcdbbdf4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ms.pak

Filesize
315KB

MD5
075775491047cf7ffbf8a6929b7bf6d1

SHA1
a4aa23038accabdaceada521cf80178a070728a4

SHA256
b3fad2a10a202cd7f1bca16d3fe6447151803769abcf5603b4c713b84b835e88

SHA512
0c4c4b9b4a24102dc271028fc2d1ab59ad81af9b3be119275956e78b1812e0c5606e8ae33cd10a9eef78862108176dc4f966218a590a157887e27738776fbb35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\nb.pak

Filesize
163KB

MD5
3883ee39fbd70b197891b6deec2c636f

SHA1
e665560d2fcc1af790b2855df5ec38abf5f040ff

SHA256
d787616e287377381803e8f5726c648adb558dd7c06ed713dcab4b57953a191d

SHA512
b7edc15169f27901db15b6ab6fca691607463d733c433fc61c2b7a0d5483ac10520bb0274904089f5911c715697ee1ac138c6e32260f18030f78d39e849f55b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\nl.pak

Filesize
180KB

MD5
64be37d4fdbf6a7b4bd041b420deb7d1

SHA1
e0f0ecdc4e1d2c27f67b0225128ade6ff04587d9

SHA256
380f2e4080c0557e2babf419bb6abd1c3371e6cd87b2c71d4796163644dcb8fe

SHA512
980bb62cf07583af4300bad34d404ec0d10fa9e0beddbecef75b4ac71fc7041af2b11e138bfa73a0526e916005ecec508793d8db9e4aa18430264197c99a44d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\pl.pak

Filesize
293KB

MD5
252f05c093be9395a17bf295e0069bf7

SHA1
0da22449c0f75bb429300709950b9e71ea9b5c27

SHA256
1f6b4f08fbe2764370a4afd038c782f84361345a842d88459123e7cd608d9b24

SHA512
0a5187acd89ec41a6f755635fc472082832f425f931fa42dd382c4e8796d89560be120b189190836845d48de77663e9313a2f4593e458fb2cbfaa2cc65f2bbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\pt-BR.pak

Filesize
342KB

MD5
3dbc04cd94c16cd7cab2172637082bce

SHA1
04a7a8d474aa184a2fbddd13397bdb66286bba3c

SHA256
78f9052f50d544c94240ff48d0457d8de92f4d314f650ac9039e3e8c1fcf3aea

SHA512
bacca944215f0f9d05a50e3aef81f7c040a0db78fdb29da333131f7178e9d801642901fe370719ffaf87709b0a43f95ea82deaf3f071c7fe00f69f2e53a1b9fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\pt-PT.pak

Filesize
191KB

MD5
af59a4fcb6e8f2b8f2e2eefad10d9f63

SHA1
c1b6050f1ba81af4d97ddc50b701dfb658159a87

SHA256
b177beee97f319ef8acae8e8883326bb7e19c7f4c6c7cc1938fa7ad89462bd35

SHA512
2420f647ea857d80d04bbd39d6cbbc2a70c2efc834dde8c08dabe85c8a375dfa7f799f0ff0c2bceb9f3096c6ecd80256bcf2cc3cc8c10967c98896ab97fa84cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ro.pak

Filesize
362KB

MD5
0570c0e2e5e56b7ad6d57ccc2e0afec0

SHA1
cf4ed45aa67ebf6307cc2d8cd4f0477fb268655e

SHA256
4c1c82242705dad5ee0fbb9f0d5c12109e4651d2634d2eccf102689f61fc55a7

SHA512
9f7096b696df7f92af162d17dc03f412e3e30f8bee769e3d6513d7a41f75950d23a9ad2873142c09641a8e9281836c753bbf703a5f18804dd9c342e0aff098e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ru.pak

Filesize
163KB

MD5
ebd252f776bbef2490534153c5ac4f55

SHA1
bdc9f6ee30b3b6bcb3517488c07a4eb50225dd39

SHA256
7488175070eb940c217d5e5a4e032f1b910eba5a31c27cce63624628e8369c49

SHA512
45f1e351030789deafc319d524dc1616055e42865eb3bbea291c73e4c21191c44176245e485aae76ba21f4eda9024a43c85cef35b660cab0d67454712f287b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\sk.pak

Filesize
177KB

MD5
6915ec3d60c8daa66f5a7a57df48f33c

SHA1
f1f298b803e7f3cfd3d57a1ed8cb0c1f356f4012

SHA256
899be90bdb6f8cdb33b88f589396569d57459dda591243de286d10b264cc608c

SHA512
afe4d163c4af63d1ba7ace5bfef2fdb8b669996efe0f97f3125ec74669584b9683ff69a324dd8130ac24b100eadbc966d7edad7d278716d8af3e60325955233d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\sl.pak

Filesize
328KB

MD5
891ce07aa0298151cab28755d0a09ef8

SHA1
0971fc44f943ebecd888f8064f92fb6bfcf2fe3b

SHA256
45f668dd59c3c3f355039e3dc9bcd88271188c2061c0bb2cf062e63bc5383c19

SHA512
a92acb4c09f0390a412d43fa05dee5ecd002839fce27682fff417778a6aa8eee9d57af6608e0111425d235f0985cc64157d915bb75427784bb0c016fba50d47f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\sr.pak

Filesize
190KB

MD5
da1cd8f326f11d3cd3c5c734a0f25f21

SHA1
afaff8e7d387c58b77f5f5a14794a0f6e26b6d91

SHA256
3f4c62565a3cac3a1d3b86cbcf62e0eab3045d98b7d9e5cb26b5744c4940f164

SHA512
83979eba6939befe2173ac62dd02bfc1105cf30921f928945889d5354949a1f33d126b21ea6fbe5eba27a27babb8adbc57c65c20eafdf3ec7298ab921cab9ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\sv.pak

Filesize
311KB

MD5
bce8222084eb35af157730fb5e343976

SHA1
cbf08eb0f93cd0d26d500d189b9b94246aa89d1a

SHA256
4dc5828ab895acfb3cf6b6fec3dc397c63a30ee101260217769d89a2389e9308

SHA512
3db57c9c938605528b7f36926fd55386be3756a616b065eb11f4743fd41cac8076a4271a7660951f2589c3bf9be893226d2f5f0f3e2f563f0416eed6f74b2696

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\sw.pak

Filesize
221KB

MD5
0ffb08414678a453ecf423092f4c229a

SHA1
05c46a780241df21016e061999e6693e39b289cc

SHA256
82fd082fb06e7f68b936e8229323d990b127b1ed7a2d1d8e74c611ded4d9ccd8

SHA512
9614b9f8d6c47b00213a8e26bc0ab680920cda9de5ed95a8305ffac19893bd1a62400c8948d30fb73e535447887e9c41ced0b80fa04067241539521bab948ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ta.pak

Filesize
174KB

MD5
cc6bde578c901a34c11bd18a95ca6a66

SHA1
e31f5c2c691cd664131c8d138ffeb1c2a2cd9f3d

SHA256
dbcca63428fc8d240bae24374a3f9380ec4d8d5035ed8711558df55d52242f3b

SHA512
37030eb6cc56ca7092e493c4900e2a937b0cb5ca9f17933b6ce716cc394c4f4d0ffabce00975a0d13f68ac037973c4d44143ab6f0275a661a93f5429eb6e4454

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\te.pak

Filesize
213KB

MD5
946a618ddf5db59e7d5b4951373f8ffc

SHA1
464ef070285a55fb201ed2429c801155368d6f80

SHA256
ae472c51f0d43e85368145e69f07927b38644c3defa1b8fb2c9d88aa00c5d84c

SHA512
d2ed87dc0171a66e97aea37036b63a09b4ffd88ccd1d722ae7e6a3ee9fe0efcced9fab30e2cb8472aba0b6b5fd5f8b9acada6fbe7e213d9bd9b44f648b0d3542

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\th.pak

Filesize
342KB

MD5
7d2c0babead07b7dfdc5dfbcdd421160

SHA1
408378d5f3d49a9acc6d63c815bcf4b7aea1f0ab

SHA256
3c229ce18c9243a6312664b5192142b2633f8c728350d6c7ac97c804684e395a

SHA512
fe2de9ecd82ae98d583320fd65e21d4c4059866a4bd8dfeb3f321f04da824ab8fd9e3eeee6629f3b46c64522bac15dc0b2dc4b20f590b378b88708fad7e033ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\tr.pak

Filesize
265KB

MD5
8b57da443108193d427bfd80b76a1f80

SHA1
b3ad8be73b07d2999c9f249394e580541b750c2f

SHA256
4179b324db123b6abf103e055afcc02777421e763672e1bacfaf996031a3d132

SHA512
3eb3906f4830fdb2e7a96d2e91fb98b6da38cfeb8a66a2f190dc6e2b1989638db63764f05e55b53ae8e668fc2d0f9613bffba08f390be7d702ffed5101724bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\uk.pak

Filesize
220KB

MD5
ca93d9d80bf9ec4733d114b9814ed2e9

SHA1
62a52c7e8edb5afb82f7bbc9a4f9757cc5a6231b

SHA256
8e621a835b96b7da7e3afc843ff370be6a88fe5b366aab5b05ad8aea529d30a4

SHA512
a36514e698808930007ec9b99f978e56f94e1dd96ae129fda75d45aa0cdeae1110178fb49871d4a73c6b255a427f5e00f2642c67d3192c022cfbc7b50911977f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\ur.pak

Filesize
289KB

MD5
f83693a626a4979a21a0a1b5d153c505

SHA1
c00251225d174a604c4b271e4c4aa2fd177c47f9

SHA256
9741d02f081b9e92cf1b72dbfa6091aadb03cfb6c9da21244c51d20fa61d471c

SHA512
7ee9bf5ae51928e24397496b647f26e089cbbef9ed12b7c090cbc08b55fb165ac8fee59d47090e6e1a45b5cf449f0c87acaebbb77c2c066c55a33c70b6560444

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\vi.pak

Filesize
214KB

MD5
39f516573edf1b051f7fd59a91b21f72

SHA1
b7ff1f9a2c1d8ad9439f7afa6287ccc94d15dccf

SHA256
aaa4a0343a31bc57902f03d3e7c4c9f558cc39eea504d1f8c5d3c5a4a93cbafb

SHA512
fd9255bc0be8b2f1933fc0a2c7c26d6373799bdce3ff3713022ccc48e1343bbf8f1405a38eff6519c5efbd97a8b67668ab707763b84cbfc993f0a76f229f6772

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\zh-CN.pak

Filesize
274KB

MD5
f0cd359bd14ed2a00a52ccc7c856b456

SHA1
f5eb29faa1e9b1b4d52a8b3e5097f9e2810e6640

SHA256
2d93245863c9bdc1b1a877bb6cd15e589335b9e8ebf2a0138d3201fd910091bb

SHA512
83782598a41963d866d9d09a0bfa77670ebf212d6af8af27197ddb0f304ec10e86510d508b4fea0d11cd81e49a3a32449256e90a07a2435392419af570120755

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\locales\zh-TW.pak

Filesize
148KB

MD5
7cf131d87c88650a777a19139bfac708

SHA1
a2c77d43ce6eee978149019306e82e1bf0fa3a1e

SHA256
d0e4e15e2f9dde8df72f0ce7fb06f2fcee10d405fa487072614869c54f52b254

SHA512
08a959ef0b8e957e8d82deec347f1e621206558a916b436a04870c26e2355729d98bc0e4060baa6e331dbebf3910c8a4898ab683e7ba0df5ca7f79d9bd58830b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\resources.pak

Filesize
447KB

MD5
b6c8a8aef1c14139e6eb8394cb6a11a0

SHA1
67146481dd96cfc355a38f1783b452b56e6cbb76

SHA256
67eabdf0299e50c795a6f4fae36454e900357ea55a3a26f088a87d16b11313ec

SHA512
219c5d2563aea8f4ecd4fcde157971bd3d91285e36ec0417a6c943e0b4b22858a12e65bb573ceef613dcbd44ecd5f82ef04308d415ad54851041497555404f33

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\resources\app.asar

Filesize
165KB

MD5
d75b3941bf965ef6bf2705b5fadee1c1

SHA1
e87515f7d638de654d9e7881d9ac78da197df023

SHA256
b9d8bfe8c858b05cefabceafb5740389fed75f6c3a5778ac968fde68f65c847c

SHA512
9f3c2227dedce1a3126383a44c7a02b87bd1c0494b3d19951e7d4adeb5fe33bd9ba5ab8e9530f1733f94cf087863b3f74e9421e9d8f20ce9cb19500bb0631bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest

Filesize
350B

MD5
8951565428aa6644f1505edb592ab38f

SHA1
9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

SHA256
8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

SHA512
7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js

Filesize
3KB

MD5
d226502c9bf2ae0a7f029bd7930be88e

SHA1
6be773fb30c7693b338f7c911b253e4f430c2f9b

SHA256
77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f

SHA512
93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat

Filesize
13KB

MD5
da0f40d84d72ae3e9324ad9a040a2e58

SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\resources\elevate.exe

Filesize
33KB

MD5
a11d89a263e80ed77ea4d33394b9c76d

SHA1
f98080407d36547c3eba09fb2075d5a13546cc15

SHA256
1535d7a170db0ae7a0cb3fe854e0e4c75b579d68c7000a20a7d1a094e8a1f89c

SHA512
14190aa1852c38a414573f615e04bb647a9983dc336d337605fa822dd0a1e10a3b6467f718d56dc044cd1f54570a9582c45c30211b59114eb945ccc5cf3ab45b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\snapshot_blob.bin

Filesize
270KB

MD5
d20922aefcad14dc658a3c6fd5ff6529

SHA1
75ce20814bdbe71cfa6fab03556c1711e78ca706

SHA256
b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621

SHA512
dbd63a9f01feb3c389c11b55d720b5d689558626041fb1dd27ded2be602e5e2a8d210f785fde025d7b9959f81de3df7fef06981269b58be564df05aec190dd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\v8_context_snapshot.bin

Filesize
431KB

MD5
9911a4e2ef6b80ba175a4b788c8591e3

SHA1
4234756e84d04785787ca57f34da9feb91c0ab8f

SHA256
74f6d591deb362e54fa3d2f70c889b2e5f50b57729f19e2fcbbeedb4971e74d9

SHA512
82cba28a465c04fd00a664594f658e557cb992d7f26d9b6bf0b1b8b7f586cf96f483db7c1cf3fd7b771cd384a31bf7bc48ad85ad97d6a45b500d1f2298cc6e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\vk_swiftshader.dll

Filesize
188KB

MD5
938b9085df224678b787d8cb5e46ae39

SHA1
3788d09a4165556d0602b9bb487f9a830bd46c17

SHA256
948df8120e4ff5d04a836ac1d6ff03bac52b292a5571164510cbca2e0b75a167

SHA512
be9ef95706387d75041c4a0230d9868761ae5d2f34c7b75892d6f9e1bced117cd6c0891e82bac80efb6081f89ddde159ff387164eaab5f723eed74b41431d723

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\7z-out\vulkan-1.dll

Filesize
139KB

MD5
1552fef106d9bd28177ee476acce6cec

SHA1
3bb0ad48979674ca6b8952630d1fd0ee01437339

SHA256
ab3c20b8bf87e7ac0ebafe6b483634494efe5d18c05490ca1d1098ba3de4d0fd

SHA512
9c25d76236da2c6c890acc7cc54db50e35d50bc3a3e99f51083aac4704d1ad252708b7cc5b9aa03e1533b09d7e81937c39825db3391112b678172f567282ba98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\CSCEFA2F9EDFEAF42688C29FA858605FE1.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Filesize
12KB

MD5
da269abfe7696ae400d3acae46b7463b

SHA1
4f6df5d316f151270d10530629d78d96115e0011

SHA256
9acf0ea1ea5851f91b6b676ffcde5e563b0927b80c288d73bd4bf6a3a6b65647

SHA512
c845f371e7caa4dd1cf1a8ee0b4d93b7ab6176abaede140a7ff3569cd3986cdc3d51f1cfc3ef2d816a79ccd9d5aec51f187ab410c84e2d9d1732649f9e2f7421

Download Submit
C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State

Filesize
300B

MD5
260ab3a18208aabbabd1068b399fdc26

SHA1
b6608e6da0b2fe7db420cd0c100a162ff884a97e

SHA256
379b6467d129f79ec5d0ea069c28c413a2bda2ac18cdee73a5474f95ed04ae47

SHA512
3f034f03cdfa93fbaeb1a5ca042516d1938be803da6d0fddaf1677f4625ba6359f593653341bcd71dcca86669a441397211ad6e71475ea4d9e960a19323e4ed4

Download Submit
C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State~RFe592c94.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Filesize
12KB

MD5
226d6ec964537284d15d63518bf80ef9

SHA1
5cad6972906a7b4306dc8ca2bc2e8256b61f6bbe

SHA256
2d1d135612fe79bbd788ef9bdef468bdf14f91bb5134c0fde0243c8b06aca794

SHA512
a2caae25dae595dd352c2c34526103f9ac6ecc756ebafa4fa3729d769b1ad53db624767dad28a23e0558d6dec0c0e689611411e0859068df4a58d427c5b9358e

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\d3dcompiler_47.dll

Filesize
219KB

MD5
f1343f4a4f290dbf735815b90ad65db8

SHA1
7600ef8c752f1e18f9e4c46a0bc98defcda85e4e

SHA256
0678cd1990e2ef875da34d74aa3971652aa23ef4016f642ceec5d792f9ec6018

SHA512
029b312401618e4a10aa515c62f4607d8daf1891578098bbbbc6880285008740fb2e96afd519f7e2934b5ae70506e71fb9c7e11f40b0b41492d571147022f54c

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\ffmpeg.dll

Filesize
217KB

MD5
339d6a6c289496a5381c4f236974e004

SHA1
a751cd2117b3d214e8e334e033de5db1b8d9ac5a

SHA256
25409710c9a453d9150a73ef8670bf721228c9a2fe5d6fe7a76be3cf571d2563

SHA512
e507bbe211711207e0d5d177c955b3c6323832553096401e2329b8ae68948f157fcbd5c56d81e2968a776609e487ce0b12158a23a268ad4e60a6a3da17dfbe73

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\ffmpeg.dll

Filesize
13KB

MD5
918aa2139b648da769f91eb2bc137f2d

SHA1
ac861ecb39a7eca5a8245c0d4cf7d6ea5b019f09

SHA256
098f6343bcfa5d4be46044234603bacdd11abe5a8f375911f756364abfb8025b

SHA512
853f1fb1dbfdb7dfe9feb03cb60065c709fe88ccc215ee5af865309ca545f52676bf37ee7af7d5d11c27dc8146d15ed1fdeac208ede6403b293394f18b757e73

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\ffmpeg.dll

Filesize
128KB

MD5
f4183c6136ecde52f1a7e7e22b093040

SHA1
64149bc2a9f28f39c4600634ea7f7e7186cd096c

SHA256
419e3f044c5cf98fd82736153e1fc44e510831f70b5748abf053b41af6949df8

SHA512
9a47c154cab6aba217ebd872e9f79dbc70531736c07a33bed2d3e15647088615a909474e33f3973fc019e89716f11855ed36e59e93a371fcc42719ce1a814167

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\ffmpeg.dll

Filesize
192KB

MD5
7f7eede7b6424ae0d99686ef2a611a1f

SHA1
83e348e7f355ee37b5a40637af751647c0d90f57

SHA256
fe99e9efee978f40e31072db92744b0625f5720121ac0664304dc36810978c2a

SHA512
5a363a344a8d4fafb16f2a444ad1329127cf4cc26072c904e38fcf8eec7a7e2152b0a47d7e57fd72dbbce2d658745b6e16739b35590524b227db2289d3f45a8f

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\libEGL.dll

Filesize
192KB

MD5
f01fe96a33bb950ce8b545c966af12c0

SHA1
495f84e3dd9ea9091490558139d27f3f5017b8e0

SHA256
0b1a5fb0fe66d2ac6303cd34f61dbb6888d37dfc6ef7580fec07f6b551cbeef1

SHA512
1c8c66c15793830b59a677ed5196f3dfbed46d559bed11e17cb9814b7b854a1c9e3fcf2689d761315540215fa57b57a1434dcdcd65d91bb0ca10b3a7071fc9fb

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\libGLESv2.dll

Filesize
96KB

MD5
aa9b6127fc40eefbda86e77b997e73b0

SHA1
3f2695635667161b9a91da5f1b8a9b34f5f31c40

SHA256
c11fcb20d260d4e553773885ab9faf167b5430b549b5d0ebe7b3c09f91e2cc76

SHA512
8365dfd86428669f01f0a980570a8d541119579289d5b6095048085a828825b029a2de4cd904934267e75f669bd1f3693ebf6a7ec371c416cdec3f2b24fc4ca7

Download Submit
\Users\Admin\AppData\Local\Temp\2dBrV7OCpQwIQ1ScjzEYLATQm8A\vk_swiftshader.dll

Filesize
256KB

MD5
44511c54a8036dec5079371bbadabab8

SHA1
836637888e99891e679e5551c2717cec8efc4935

SHA256
aada7ec67c420de5af1b7d5cfd6c9e87e8ca9dc75eae9e8ae9c5ee9aee358b62

SHA512
66f550c28250c7ffee4d648a5c40936362e6a8728279dc69483af1318c134020d565895618712902e975e27441ee547633bc4f5d8cea0936e53802f1640996c1

Download Submit
\Users\Admin\AppData\Local\Temp\cb6dbadf-7a0c-4789-aef6-0fcda34eec3d.tmp.node

Filesize
81KB

MD5
d0b6b6693194342dcd619d121ebe6f23

SHA1
0c65e6b15a221c15fb007a3cb19bc995239dd5bc

SHA256
ad29861ef8ba776fe60bac224e85d7104fa2d87dbf4207de9e41a0da71cfa671

SHA512
7e31d8b7ef67533a2b979a57565661a16ed91d6cbc54e7f34291491ff174e3bfbdf0184554ab91c3da0c3b990c022d38c2d49192e9bfa8c6b2b80022b48ca3b4

Download Submit
\Users\Admin\AppData\Local\Temp\f76b41cf-9977-4ab2-b81f-db760cdbf6dd.tmp.node

Filesize
1.3MB

MD5
59baa8fa43131011c605ec6b7a41623d

SHA1
f6ccc4935bd3360b6edcf5acd6e2112e5e5d38bf

SHA256
1a27393c34d686d87b3b3368043c4902d2b49fbbf754891b6ebeb41239a8cfda

SHA512
c95ce28807e768f6525df2691d4408dd36918e17bd2514b7adc9c351707d7fba41d0288bb1dc4687c8e1072b27676046835620bb4c5acda027d4b4e119814ca9

Download Submit
\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/1464-964-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/2424-886-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/3040-965-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/4324-967-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/5368-934-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6032-966-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6296-917-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6304-887-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6324-882-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6344-930-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6356-914-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6368-933-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6384-913-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6396-944-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6444-879-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6468-859-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6468-883-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6512-959-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6576-915-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6584-932-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6596-875-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6620-884-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6644-838-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6644-858-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6716-979-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6716-878-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6724-857-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6740-931-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6744-920-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6748-961-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6752-918-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6760-936-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6788-957-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6804-874-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6832-935-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6880-958-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/6904-916-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7008-919-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7048-816-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7048-804-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7048-793-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download
memory/7064-876-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7064-819-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7076-837-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7076-825-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7084-885-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7096-843-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7096-827-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7108-877-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7108-832-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7248-960-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7248-970-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7260-968-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7408-982-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7420-974-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7420-980-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7492-987-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7592-981-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7592-998-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7600-1000-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7600-937-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7756-969-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7764-1001-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download
memory/7816-999-0x00007FFEC3D30000-0x00007FFEC471C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads