epsilon | 79ae38d3832ab7d48543039eff6078538465eb83d8fbb124db2e319295ab5e68

Analysis

max time kernel
156s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Node-js.exe
Size

134.3MB
MD5

06295a324f405a3c7082f1fbadc35f1e
SHA1

513108b3aeb2ad8491c6dd1ad74d4711bc85b2f8
SHA256

80770adbb4d1c5d6736eb80e2aa0246965a76ea99517f0e1a77c16d0f0fc4957
SHA512

41205e55908be61c0bd81fe904710b88dfb1e37d06b1c48d5b66b16f4c52ce2101991f158da3fa228e9b5511cc30563fdf6329c75a4c49554ce294c5ca0d48c7
SSDEEP

1572864:94T4NPd8vk0E4UmdhRhPoXFzcwkqwBWKEFM:v1TJXzV+

Score

10^/10

epsilon persistence spyware stealer

Malware Config

Signatures

Epsilon Stealer
Information stealer.
stealer epsilon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Node-js.exe

Executes dropped EXE 64 IoCs

pid	Process
1792	screenCapture_1.3.2.exe
4992	screenCapture_1.3.2.exe
2080	screenCapture_1.3.2.exe
1192	screenCapture_1.3.2.exe
4060	screenCapture_1.3.2.exe
2740	screenCapture_1.3.2.exe
4596	screenCapture_1.3.2.exe
3440	screenCapture_1.3.2.exe
1840	screenCapture_1.3.2.exe
1144	screenCapture_1.3.2.exe
1520	screenCapture_1.3.2.exe
1932	screenCapture_1.3.2.exe
5052	screenCapture_1.3.2.exe
3576	screenCapture_1.3.2.exe
3772	screenCapture_1.3.2.exe
2396	screenCapture_1.3.2.exe
2512	screenCapture_1.3.2.exe
1632	screenCapture_1.3.2.exe
4900	screenCapture_1.3.2.exe
2660	screenCapture_1.3.2.exe
2736	screenCapture_1.3.2.exe
2972	screenCapture_1.3.2.exe
4264	screenCapture_1.3.2.exe
3884	screenCapture_1.3.2.exe
2744	screenCapture_1.3.2.exe
808	screenCapture_1.3.2.exe
3276	screenCapture_1.3.2.exe
1860	screenCapture_1.3.2.exe
2920	screenCapture_1.3.2.exe
3780	screenCapture_1.3.2.exe
4456	screenCapture_1.3.2.exe
2548	screenCapture_1.3.2.exe
3380	screenCapture_1.3.2.exe
1520	screenCapture_1.3.2.exe
1864	screenCapture_1.3.2.exe
3840	screenCapture_1.3.2.exe
2676	screenCapture_1.3.2.exe
5036	screenCapture_1.3.2.exe
2728	screenCapture_1.3.2.exe
1904	screenCapture_1.3.2.exe
452	screenCapture_1.3.2.exe
1228	screenCapture_1.3.2.exe
2948	screenCapture_1.3.2.exe
3656	screenCapture_1.3.2.exe
2688	screenCapture_1.3.2.exe
3504	screenCapture_1.3.2.exe
1408	screenCapture_1.3.2.exe
4552	screenCapture_1.3.2.exe
2592	screenCapture_1.3.2.exe
2652	screenCapture_1.3.2.exe
2528	screenCapture_1.3.2.exe
3076	screenCapture_1.3.2.exe
3648	screenCapture_1.3.2.exe
2500	screenCapture_1.3.2.exe
2272	screenCapture_1.3.2.exe
4952	screenCapture_1.3.2.exe
4472	screenCapture_1.3.2.exe
5092	screenCapture_1.3.2.exe
1216	screenCapture_1.3.2.exe
4448	screenCapture_1.3.2.exe
1688	screenCapture_1.3.2.exe
2808	screenCapture_1.3.2.exe
2008	screenCapture_1.3.2.exe
4408	screenCapture_1.3.2.exe

Loads dropped DLL 2 IoCs

pid	Process
2012	Node-js.exe
2012	Node-js.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsBootManager = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsBootManager.exe"	reg.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ipinfo.io
14	ipinfo.io

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4508	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4740	tasklist.exe
4496	tasklist.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4816	Node-js.exe
4816	Node-js.exe
4836	Node-js.exe
4836	Node-js.exe
4836	Node-js.exe
4836	Node-js.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4100	WMIC.exe
Token: SeSecurityPrivilege	4100	WMIC.exe
Token: SeTakeOwnershipPrivilege	4100	WMIC.exe
Token: SeLoadDriverPrivilege	4100	WMIC.exe
Token: SeSystemProfilePrivilege	4100	WMIC.exe
Token: SeSystemtimePrivilege	4100	WMIC.exe
Token: SeProfSingleProcessPrivilege	4100	WMIC.exe
Token: SeIncBasePriorityPrivilege	4100	WMIC.exe
Token: SeCreatePagefilePrivilege	4100	WMIC.exe
Token: SeBackupPrivilege	4100	WMIC.exe
Token: SeRestorePrivilege	4100	WMIC.exe
Token: SeShutdownPrivilege	4100	WMIC.exe
Token: SeDebugPrivilege	4100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4100	WMIC.exe
Token: SeRemoteShutdownPrivilege	4100	WMIC.exe
Token: SeUndockPrivilege	4100	WMIC.exe
Token: SeManageVolumePrivilege	4100	WMIC.exe
Token: 33	4100	WMIC.exe
Token: 34	4100	WMIC.exe
Token: 35	4100	WMIC.exe
Token: 36	4100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4100	WMIC.exe
Token: SeSecurityPrivilege	4100	WMIC.exe
Token: SeTakeOwnershipPrivilege	4100	WMIC.exe
Token: SeLoadDriverPrivilege	4100	WMIC.exe
Token: SeSystemProfilePrivilege	4100	WMIC.exe
Token: SeSystemtimePrivilege	4100	WMIC.exe
Token: SeProfSingleProcessPrivilege	4100	WMIC.exe
Token: SeIncBasePriorityPrivilege	4100	WMIC.exe
Token: SeCreatePagefilePrivilege	4100	WMIC.exe
Token: SeBackupPrivilege	4100	WMIC.exe
Token: SeRestorePrivilege	4100	WMIC.exe
Token: SeShutdownPrivilege	4100	WMIC.exe
Token: SeDebugPrivilege	4100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4100	WMIC.exe
Token: SeRemoteShutdownPrivilege	4100	WMIC.exe
Token: SeUndockPrivilege	4100	WMIC.exe
Token: SeManageVolumePrivilege	4100	WMIC.exe
Token: 33	4100	WMIC.exe
Token: 34	4100	WMIC.exe
Token: 35	4100	WMIC.exe
Token: 36	4100	WMIC.exe
Token: SeDebugPrivilege	4740	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4880	WMIC.exe
Token: SeSecurityPrivilege	4880	WMIC.exe
Token: SeTakeOwnershipPrivilege	4880	WMIC.exe
Token: SeLoadDriverPrivilege	4880	WMIC.exe
Token: SeSystemProfilePrivilege	4880	WMIC.exe
Token: SeSystemtimePrivilege	4880	WMIC.exe
Token: SeProfSingleProcessPrivilege	4880	WMIC.exe
Token: SeIncBasePriorityPrivilege	4880	WMIC.exe
Token: SeCreatePagefilePrivilege	4880	WMIC.exe
Token: SeBackupPrivilege	4880	WMIC.exe
Token: SeRestorePrivilege	4880	WMIC.exe
Token: SeShutdownPrivilege	4880	WMIC.exe
Token: SeDebugPrivilege	4880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4880	WMIC.exe
Token: SeRemoteShutdownPrivilege	4880	WMIC.exe
Token: SeUndockPrivilege	4880	WMIC.exe
Token: SeManageVolumePrivilege	4880	WMIC.exe
Token: 33	4880	WMIC.exe
Token: 34	4880	WMIC.exe
Token: 35	4880	WMIC.exe
Token: 36	4880	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3036	2012	Node-js.exe	88
PID 2012 wrote to memory of 3036	2012	Node-js.exe	88
PID 3036 wrote to memory of 4100	3036	cmd.exe	90
PID 3036 wrote to memory of 4100	3036	cmd.exe	90
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 2964	2012	Node-js.exe	91
PID 2012 wrote to memory of 4816	2012	Node-js.exe	92
PID 2012 wrote to memory of 4816	2012	Node-js.exe	92
PID 2012 wrote to memory of 1472	2012	Node-js.exe	94
PID 2012 wrote to memory of 1472	2012	Node-js.exe	94
PID 2012 wrote to memory of 1656	2012	Node-js.exe	96
PID 2012 wrote to memory of 1656	2012	Node-js.exe	96
PID 2012 wrote to memory of 5060	2012	Node-js.exe	97
PID 2012 wrote to memory of 5060	2012	Node-js.exe	97
PID 1472 wrote to memory of 4728	1472	cmd.exe	100
PID 1472 wrote to memory of 4728	1472	cmd.exe	100
PID 1656 wrote to memory of 3376	1656	cmd.exe	101
PID 1656 wrote to memory of 3376	1656	cmd.exe	101
PID 5060 wrote to memory of 4740	5060	cmd.exe	102
PID 5060 wrote to memory of 4740	5060	cmd.exe	102
PID 2012 wrote to memory of 2724	2012	Node-js.exe	103
PID 2012 wrote to memory of 2724	2012	Node-js.exe	103
PID 2724 wrote to memory of 4880	2724	cmd.exe	105
PID 2724 wrote to memory of 4880	2724	cmd.exe	105
PID 2012 wrote to memory of 568	2012	Node-js.exe	107
PID 2012 wrote to memory of 568	2012	Node-js.exe	107

C:\Users\Admin\AppData\Local\Temp\Node-js.exe
"C:\Users\Admin\AppData\Local\Temp\Node-js.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic CsProduct Get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- C:\Users\Admin\AppData\Local\Temp\Node-js.exe
  "C:\Users\Admin\AppData\Local\Temp\Node-js.exe" --type=gpu-process --field-trial-handle=1640,15988592063297420386,14195150436517721813,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Node-js" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\Node-js.exe
  "C:\Users\Admin\AppData\Local\Temp\Node-js.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,15988592063297420386,14195150436517721813,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Node-js" --mojo-platform-channel-handle=1960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:568
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
  2⤵
  PID:4876
- - C:\Windows\system32\cmd.exe
    cmd /c chcp 65001
    3⤵
    PID:5016
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:336
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
  2⤵
  PID:64
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
    3⤵
    - Adds Run key to start application
    PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-g7l8x7.gu7q4.jpg" "
  2⤵
  PID:1704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
    3⤵
    PID:4056
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC0C.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC97E0769C437E403BB6AC9E80CDA8CD26.TMP"
      4⤵
      PID:1108
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-g7l8x7.gu7q4.jpg"
    3⤵
    - Executes dropped EXE
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-14tdgzx.l2t7l.jpg" "
  2⤵
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-14tdgzx.l2t7l.jpg"
    3⤵
    - Executes dropped EXE
    PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-gato2w.km8ek.jpg" "
  2⤵
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-gato2w.km8ek.jpg"
    3⤵
    - Executes dropped EXE
    PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-19ha239.lf2f.jpg" "
  2⤵
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-19ha239.lf2f.jpg"
    3⤵
    - Executes dropped EXE
    PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-a25pq3.6qec.jpg" "
  2⤵
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-a25pq3.6qec.jpg"
    3⤵
    - Executes dropped EXE
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1byiezb.vq3pg.jpg" "
  2⤵
  PID:836
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1byiezb.vq3pg.jpg"
    3⤵
    - Executes dropped EXE
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wgz2t9.qzwph.jpg" "
  2⤵
  PID:4000
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wgz2t9.qzwph.jpg"
    3⤵
    - Executes dropped EXE
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1csyi24.yj0p.jpg" "
  2⤵
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1csyi24.yj0p.jpg"
    3⤵
    - Executes dropped EXE
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-qua8ok.8lft.jpg" "
  2⤵
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-qua8ok.8lft.jpg"
    3⤵
    - Executes dropped EXE
    PID:1144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-14hpxha.fmzkj.jpg" "
  2⤵
  PID:3384
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-14hpxha.fmzkj.jpg"
    3⤵
    - Executes dropped EXE
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-utlxrx.jjl59.jpg" "
  2⤵
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-utlxrx.jjl59.jpg"
    3⤵
    - Executes dropped EXE
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-163eac3.lh59.jpg" "
  2⤵
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-163eac3.lh59.jpg"
    3⤵
    - Executes dropped EXE
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1fz2dmw.wc3o.jpg" "
  2⤵
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1fz2dmw.wc3o.jpg"
    3⤵
    - Executes dropped EXE
    PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1264gnf.x4nw.jpg" "
  2⤵
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1264gnf.x4nw.jpg"
    3⤵
    - Executes dropped EXE
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-88sit.5h5ne.jpg" "
  2⤵
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-88sit.5h5ne.jpg"
    3⤵
    - Executes dropped EXE
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jebv6m.tvi9.jpg" "
  2⤵
  PID:4740
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jebv6m.tvi9.jpg"
    3⤵
    - Executes dropped EXE
    PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1yn0ayc.uvyx.jpg" "
  2⤵
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1yn0ayc.uvyx.jpg"
    3⤵
    - Executes dropped EXE
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1aqqo83.kamy.jpg" "
  2⤵
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1aqqo83.kamy.jpg"
    3⤵
    - Executes dropped EXE
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wyazbx.rqmoj.jpg" "
  2⤵
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wyazbx.rqmoj.jpg"
    3⤵
    - Executes dropped EXE
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-bdx0qc.zbwks.jpg" "
  2⤵
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-bdx0qc.zbwks.jpg"
    3⤵
    - Executes dropped EXE
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-8od1ni.m3hes.jpg" "
  2⤵
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-8od1ni.m3hes.jpg"
    3⤵
    - Executes dropped EXE
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1s1te3m.7s94.jpg" "
  2⤵
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1s1te3m.7s94.jpg"
    3⤵
    - Executes dropped EXE
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-k4vkv7.11ye.jpg" "
  2⤵
  PID:3384
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-k4vkv7.11ye.jpg"
    3⤵
    - Executes dropped EXE
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1i2q7kq.9q88.jpg" "
  2⤵
  PID:4000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1i2q7kq.9q88.jpg"
    3⤵
    - Executes dropped EXE
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-14ilnht.wfpt.jpg" "
  2⤵
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-14ilnht.wfpt.jpg"
    3⤵
    - Executes dropped EXE
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-14xohvr.tusu.jpg" "
  2⤵
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-14xohvr.tusu.jpg"
    3⤵
    - Executes dropped EXE
    PID:808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1p5sr7g.rws8.jpg" "
  2⤵
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1p5sr7g.rws8.jpg"
    3⤵
    - Executes dropped EXE
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-o74mya.nfosg.jpg" "
  2⤵
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-o74mya.nfosg.jpg"
    3⤵
    - Executes dropped EXE
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-2m06x1.e8mi4.jpg" "
  2⤵
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-2m06x1.e8mi4.jpg"
    3⤵
    - Executes dropped EXE
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ftluj3.p29iv.jpg" "
  2⤵
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ftluj3.p29iv.jpg"
    3⤵
    - Executes dropped EXE
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-rnkjvu.mbeb.jpg" "
  2⤵
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-rnkjvu.mbeb.jpg"
    3⤵
    - Executes dropped EXE
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-w5i5iv.00uz.jpg" "
  2⤵
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-w5i5iv.00uz.jpg"
    3⤵
    - Executes dropped EXE
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-po8y3e.lsze.jpg" "
  2⤵
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-po8y3e.lsze.jpg"
    3⤵
    - Executes dropped EXE
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-113qbfa.qwst.jpg" "
  2⤵
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-113qbfa.qwst.jpg"
    3⤵
    - Executes dropped EXE
    PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-bat6g4.188n.jpg" "
  2⤵
  PID:3700
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-bat6g4.188n.jpg"
    3⤵
    - Executes dropped EXE
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-t4l4ss.y3kc.jpg" "
  2⤵
  PID:4056
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-t4l4ss.y3kc.jpg"
    3⤵
    - Executes dropped EXE
    PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-173lr5j.669qi.jpg" "
  2⤵
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-173lr5j.669qi.jpg"
    3⤵
    - Executes dropped EXE
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-8344bi.35wpp.jpg" "
  2⤵
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-8344bi.35wpp.jpg"
    3⤵
    - Executes dropped EXE
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-m9pgod.ejov.jpg" "
  2⤵
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-m9pgod.ejov.jpg"
    3⤵
    - Executes dropped EXE
    PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-11kis9h.0fvb.jpg" "
  2⤵
  PID:4540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-11kis9h.0fvb.jpg"
    3⤵
    - Executes dropped EXE
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mtgefe.p3mx.jpg" "
  2⤵
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mtgefe.p3mx.jpg"
    3⤵
    - Executes dropped EXE
    PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-wqv612.8lo1g.jpg" "
  2⤵
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-wqv612.8lo1g.jpg"
    3⤵
    - Executes dropped EXE
    PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1vkhfvx.z1tt.jpg" "
  2⤵
  PID:3376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3152
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1vkhfvx.z1tt.jpg"
    3⤵
    - Executes dropped EXE
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-p90ptq.0fq7.jpg" "
  2⤵
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-p90ptq.0fq7.jpg"
    3⤵
    - Executes dropped EXE
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-12m1748.ctocg.jpg" "
  2⤵
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-12m1748.ctocg.jpg"
    3⤵
    - Executes dropped EXE
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-viq4w4.dxg1s.jpg" "
  2⤵
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-viq4w4.dxg1s.jpg"
    3⤵
    - Executes dropped EXE
    PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-11v0hd2.j6ns.jpg" "
  2⤵
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-11v0hd2.j6ns.jpg"
    3⤵
    - Executes dropped EXE
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1enm55r.z0ha.jpg" "
  2⤵
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1enm55r.z0ha.jpg"
    3⤵
    - Executes dropped EXE
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1a6niuq.68ew.jpg" "
  2⤵
  PID:860
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1a6niuq.68ew.jpg"
    3⤵
    - Executes dropped EXE
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-arlrot.db9dd.jpg" "
  2⤵
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-arlrot.db9dd.jpg"
    3⤵
    - Executes dropped EXE
    PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-39xt9l.r7s4z.jpg" "
  2⤵
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-39xt9l.r7s4z.jpg"
    3⤵
    - Executes dropped EXE
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1ym69cp.ce8s.jpg" "
  2⤵
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1ym69cp.ce8s.jpg"
    3⤵
    - Executes dropped EXE
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-prwpck.c0jnh.jpg" "
  2⤵
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-prwpck.c0jnh.jpg"
    3⤵
    - Executes dropped EXE
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-5ikhus.1g9zm.jpg" "
  2⤵
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-5ikhus.1g9zm.jpg"
    3⤵
    - Executes dropped EXE
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-kjyl1n.4j96.jpg" "
  2⤵
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-kjyl1n.4j96.jpg"
    3⤵
    - Executes dropped EXE
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-18w5l2p.g265.jpg" "
  2⤵
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-18w5l2p.g265.jpg"
    3⤵
    - Executes dropped EXE
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ld234f.arf0p.jpg" "
  2⤵
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ld234f.arf0p.jpg"
    3⤵
    - Executes dropped EXE
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-984sk9.w36ok.jpg" "
  2⤵
  PID:836
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-984sk9.w36ok.jpg"
    3⤵
    - Executes dropped EXE
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-rusa38.pehuc.jpg" "
  2⤵
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-rusa38.pehuc.jpg"
    3⤵
    - Executes dropped EXE
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1nx5o9y.n075.jpg" "
  2⤵
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1nx5o9y.n075.jpg"
    3⤵
    - Executes dropped EXE
    PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1ord9lf.twyz.jpg" "
  2⤵
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1ord9lf.twyz.jpg"
    3⤵
    - Executes dropped EXE
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-18kp7bw.bit9.jpg" "
  2⤵
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-18kp7bw.bit9.jpg"
    3⤵
    - Executes dropped EXE
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-12gnpb6.il0n.jpg" "
  2⤵
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-12gnpb6.il0n.jpg"
    3⤵
    - Executes dropped EXE
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1h7n224.zh4cf.jpg" "
  2⤵
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1h7n224.zh4cf.jpg"
    3⤵
    - Executes dropped EXE
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1738w2l.5q3o.jpg" "
  2⤵
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1738w2l.5q3o.jpg"
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-oexq7b.wy33c.jpg" "
  2⤵
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-oexq7b.wy33c.jpg"
    3⤵
    PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1c7k41.raaq9.jpg" "
  2⤵
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1c7k41.raaq9.jpg"
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-l0kz02.5lnu.jpg" "
  2⤵
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-l0kz02.5lnu.jpg"
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-126s8em.mgvh.jpg" "
  2⤵
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-126s8em.mgvh.jpg"
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-jwglxo.aqh2j.jpg" "
  2⤵
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-jwglxo.aqh2j.jpg"
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-16liai8.8k2h.jpg" "
  2⤵
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-16liai8.8k2h.jpg"
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-tf80h5.ffue.jpg" "
  2⤵
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-tf80h5.ffue.jpg"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-17dn5k0.pty4.jpg" "
  2⤵
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-17dn5k0.pty4.jpg"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1fupaqi.h03c.jpg" "
  2⤵
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1fupaqi.h03c.jpg"
    3⤵
    PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-rjpymk.zgg88.jpg" "
  2⤵
  PID:4060
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-rjpymk.zgg88.jpg"
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-43zpnz.y6ehq.jpg" "
  2⤵
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-43zpnz.y6ehq.jpg"
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-nbdoxg.4k4b.jpg" "
  2⤵
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-nbdoxg.4k4b.jpg"
    3⤵
    PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-11roome.k7as.jpg" "
  2⤵
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-11roome.k7as.jpg"
    3⤵
    PID:3240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-152m2z5.4mq0i.jpg" "
  2⤵
  PID:2576
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-152m2z5.4mq0i.jpg"
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1pr0why.64bkg.jpg" "
  2⤵
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1pr0why.64bkg.jpg"
    3⤵
    PID:3108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-jeahpb.rsw28.jpg" "
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-jeahpb.rsw28.jpg"
    3⤵
    PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1p7y7bk.idms.jpg" "
  2⤵
  PID:4504
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1p7y7bk.idms.jpg"
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1eeo196.szu6.jpg" "
  2⤵
  PID:968
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1eeo196.szu6.jpg"
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1407hf7.9j1m.jpg" "
  2⤵
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1407hf7.9j1m.jpg"
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wc02aw.imcc.jpg" "
  2⤵
  PID:904
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wc02aw.imcc.jpg"
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-15a6lt2.96le.jpg" "
  2⤵
  PID:4820
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-15a6lt2.96le.jpg"
    3⤵
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1prpent.4wnb.jpg" "
  2⤵
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1prpent.4wnb.jpg"
    3⤵
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-14au2ev.tjrk.jpg" "
  2⤵
  PID:3376
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-14au2ev.tjrk.jpg"
    3⤵
    PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bx2rpj.5hpo.jpg" "
  2⤵
  PID:3744
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bx2rpj.5hpo.jpg"
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wxssr0.y43dj.jpg" "
  2⤵
  PID:3792
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wxssr0.y43dj.jpg"
    3⤵
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bb5e65.k8is.jpg" "
  2⤵
  PID:3368
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bb5e65.k8is.jpg"
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-16s8o0i.ju8h.jpg" "
  2⤵
  PID:4448
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-16s8o0i.ju8h.jpg"
    3⤵
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-bvui45.sqc4q.jpg" "
  2⤵
  PID:4584
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-bvui45.sqc4q.jpg"
    3⤵
    PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1i09exh.rto.jpg" "
  2⤵
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1i09exh.rto.jpg"
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-x0b563.00mqj.jpg" "
  2⤵
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-x0b563.00mqj.jpg"
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-18zam99.m5dz.jpg" "
  2⤵
  PID:2496
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-18zam99.m5dz.jpg"
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1c6ke7n.lkh6.jpg" "
  2⤵
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1c6ke7n.lkh6.jpg"
    3⤵
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1065m3g.szws.jpg" "
  2⤵
  PID:336
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1065m3g.szws.jpg"
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1l43eth.cl0g.jpg" "
  2⤵
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1l43eth.cl0g.jpg"
    3⤵
    PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ik3dp7.tj91e.jpg" "
  2⤵
  PID:4792
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ik3dp7.tj91e.jpg"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-6psrvz.07ex9.jpg" "
  2⤵
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-6psrvz.07ex9.jpg"
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-18vn5rr.teoji.jpg" "
  2⤵
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-18vn5rr.teoji.jpg"
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1j6y9kv.rb9h.jpg" "
  2⤵
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1j6y9kv.rb9h.jpg"
    3⤵
    PID:1432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-101pxam.hthk.jpg" "
  2⤵
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-101pxam.hthk.jpg"
    3⤵
    PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1rvmw5f.g3yr.jpg" "
  2⤵
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1rvmw5f.g3yr.jpg"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-2g961r.28ci9.jpg" "
  2⤵
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-2g961r.28ci9.jpg"
    3⤵
    PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-qc1opt.1nv0b.jpg" "
  2⤵
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-qc1opt.1nv0b.jpg"
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-101ur3k.n2j4.jpg" "
  2⤵
  PID:3384
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-101ur3k.n2j4.jpg"
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wyaxjk.1g67h.jpg" "
  2⤵
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wyaxjk.1g67h.jpg"
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-rwpqgs.y7z9m.jpg" "
  2⤵
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-rwpqgs.y7z9m.jpg"
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1g1hw7k.700v.jpg" "
  2⤵
  PID:3780
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1g1hw7k.700v.jpg"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-13l1fok.dkwk.jpg" "
  2⤵
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-13l1fok.dkwk.jpg"
    3⤵
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-xdk9ln.vaa.jpg" "
  2⤵
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-xdk9ln.vaa.jpg"
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-164p2gz.fo4v.jpg" "
  2⤵
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-164p2gz.fo4v.jpg"
    3⤵
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1991foa.33z3.jpg" "
  2⤵
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1991foa.33z3.jpg"
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-97q0j0.wqs3.jpg" "
  2⤵
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-97q0j0.wqs3.jpg"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gid85b.rzfh.jpg" "
  2⤵
  PID:4056
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gid85b.rzfh.jpg"
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-17parr8.wml7.jpg" "
  2⤵
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-17parr8.wml7.jpg"
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-18wzk77.931y.jpg" "
  2⤵
  PID:3532
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-18wzk77.931y.jpg"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-9vnscg.yqbnn.jpg" "
  2⤵
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-9vnscg.yqbnn.jpg"
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1c86nvk.bwl2.jpg" "
  2⤵
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1c86nvk.bwl2.jpg"
    3⤵
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-9envj4.chdsw.jpg" "
  2⤵
  PID:644
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-9envj4.chdsw.jpg"
    3⤵
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ok1x2i.f6s1.jpg" "
  2⤵
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ok1x2i.f6s1.jpg"
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-rgb9dk.6n25g.jpg" "
  2⤵
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-rgb9dk.6n25g.jpg"
    3⤵
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mvbnq5.pu7k.jpg" "
  2⤵
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mvbnq5.pu7k.jpg"
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-d2ukhg.y6vo.jpg" "
  2⤵
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-d2ukhg.y6vo.jpg"
    3⤵
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1edu55q.8kqd.jpg" "
  2⤵
  PID:3780
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1edu55q.8kqd.jpg"
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-m2qgtn.akaqb.jpg" "
  2⤵
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-m2qgtn.akaqb.jpg"
    3⤵
    PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-k1ogo5.g3jpj.jpg" "
  2⤵
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-k1ogo5.g3jpj.jpg"
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-nc763s.e7ruh.jpg" "
  2⤵
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-nc763s.e7ruh.jpg"
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-kttl0v.ej5k.jpg" "
  2⤵
  PID:968
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-kttl0v.ej5k.jpg"
    3⤵
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1iy52gj.1nnd.jpg" "
  2⤵
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1iy52gj.1nnd.jpg"
    3⤵
    PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-159en90.ctjg.jpg" "
  2⤵
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-159en90.ctjg.jpg"
    3⤵
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-5hgbcz.xuz1t.jpg" "
  2⤵
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-5hgbcz.xuz1t.jpg"
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-umynkj.7cmm.jpg" "
  2⤵
  PID:2068
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-umynkj.7cmm.jpg"
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1s1vj1z.x7n9.jpg" "
  2⤵
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1s1vj1z.x7n9.jpg"
    3⤵
    PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-htbwcy.1tgj.jpg" "
  2⤵
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-htbwcy.1tgj.jpg"
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-93qmfh.9mw3.jpg" "
  2⤵
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-93qmfh.9mw3.jpg"
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-nda1d6.imn5.jpg" "
  2⤵
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-nda1d6.imn5.jpg"
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ih22jx.rletp.jpg" "
  2⤵
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ih22jx.rletp.jpg"
    3⤵
    PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1g88bs.6ifka.jpg" "
  2⤵
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1g88bs.6ifka.jpg"
    3⤵
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-h90d10.1mtt7.jpg" "
  2⤵
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-h90d10.1mtt7.jpg"
    3⤵
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-6zaf5x.g1bpi.jpg" "
  2⤵
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-6zaf5x.g1bpi.jpg"
    3⤵
    PID:964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wtw05b.52tp.jpg" "
  2⤵
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1wtw05b.52tp.jpg"
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1k3ozfb.358h.jpg" "
  2⤵
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1k3ozfb.358h.jpg"
    3⤵
    PID:336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-er1u6n.2lrjh.jpg" "
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-er1u6n.2lrjh.jpg"
    3⤵
    PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1vu1jbr.rnkag.jpg" "
  2⤵
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1vu1jbr.rnkag.jpg"
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-15rscs0.q2dx.jpg" "
  2⤵
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-15rscs0.q2dx.jpg"
    3⤵
    PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-yqeukg.ore0k.jpg" "
  2⤵
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-yqeukg.ore0k.jpg"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-fsicvb.ki4v.jpg" "
  2⤵
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-fsicvb.ki4v.jpg"
    3⤵
    PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ph7mt9.6qta.jpg" "
  2⤵
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ph7mt9.6qta.jpg"
    3⤵
    PID:464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1tr2gww.i2ew.jpg" "
  2⤵
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1tr2gww.i2ew.jpg"
    3⤵
    PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-vavvkg.yj77.jpg" "
  2⤵
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-vavvkg.yj77.jpg"
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1fjbbyk.5pdo.jpg" "
  2⤵
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1fjbbyk.5pdo.jpg"
    3⤵
    PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-3oekjt.chbue.jpg" "
  2⤵
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-3oekjt.chbue.jpg"
    3⤵
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-17c25w2.n3zij.jpg" "
  2⤵
  PID:3264
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-17c25w2.n3zij.jpg"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1biz8mt.af5bk.jpg" "
  2⤵
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1biz8mt.af5bk.jpg"
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-c3eant.i8kfq.jpg" "
  2⤵
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-c3eant.i8kfq.jpg"
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-doetzb.1hx98.jpg" "
  2⤵
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-doetzb.1hx98.jpg"
    3⤵
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1u6dqll.q4i7.jpg" "
  2⤵
  PID:3400
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1u6dqll.q4i7.jpg"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-masqhs.5sg5i.jpg" "
  2⤵
  PID:4424
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-masqhs.5sg5i.jpg"
    3⤵
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-r6oxj3.ak63p.jpg" "
  2⤵
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-r6oxj3.ak63p.jpg"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-n17lc6.b7iu.jpg" "
  2⤵
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-n17lc6.b7iu.jpg"
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-mkkc7c.91oyh.jpg" "
  2⤵
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-mkkc7c.91oyh.jpg"
    3⤵
    PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bltpw4.kp8cj.jpg" "
  2⤵
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bltpw4.kp8cj.jpg"
    3⤵
    PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-fsd3lx.ck747.jpg" "
  2⤵
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-fsd3lx.ck747.jpg"
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-rwbpio.zklgp.jpg" "
  2⤵
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-rwbpio.zklgp.jpg"
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-4f773c.8ahgb.jpg" "
  2⤵
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-4f773c.8ahgb.jpg"
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-5o3k73.5z2tl.jpg" "
  2⤵
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-5o3k73.5z2tl.jpg"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-10xwjsu.h7y0l.jpg" "
  2⤵
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-10xwjsu.h7y0l.jpg"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ar1mk0.wbiec.jpg" "
  2⤵
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ar1mk0.wbiec.jpg"
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-fv49bq.dsb3.jpg" "
  2⤵
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-fv49bq.dsb3.jpg"
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-5nrk7s.wvw7c.jpg" "
  2⤵
  PID:4268
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-5nrk7s.wvw7c.jpg"
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-17pkc4i.j204.jpg" "
  2⤵
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-17pkc4i.j204.jpg"
    3⤵
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mg43hz.kete.jpg" "
  2⤵
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mg43hz.kete.jpg"
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-gkz9wq.uqkpi.jpg" "
  2⤵
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-gkz9wq.uqkpi.jpg"
    3⤵
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-h4e562.mqtx.jpg" "
  2⤵
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-h4e562.mqtx.jpg"
    3⤵
    PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jb1shv.9tf9.jpg" "
  2⤵
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jb1shv.9tf9.jpg"
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-16jj7bc.ebq8.jpg" "
  2⤵
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-16jj7bc.ebq8.jpg"
    3⤵
    PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-gyb93b.8jkks.jpg" "
  2⤵
  PID:4440
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-gyb93b.8jkks.jpg"
    3⤵
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-816bn6.g32r9.jpg" "
  2⤵
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-816bn6.g32r9.jpg"
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kct2hi.xfy5.jpg" "
  2⤵
  PID:4764
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kct2hi.xfy5.jpg"
    3⤵
    PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-soxlya.26jq.jpg" "
  2⤵
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-soxlya.26jq.jpg"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-5vav77.nkobq.jpg" "
  2⤵
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-5vav77.nkobq.jpg"
    3⤵
    PID:2440
- C:\Users\Admin\AppData\Local\Temp\Node-js.exe
  "C:\Users\Admin\AppData\Local\Temp\Node-js.exe" --type=gpu-process --field-trial-handle=1640,15988592063297420386,14195150436517721813,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Node-js" --gpu-preferences=UAAAAAAAAADoAAAIAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jwdzlj.g0kx.jpg" "
  2⤵
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jwdzlj.g0kx.jpg"
    3⤵
    PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hn5we3.1mrzj.jpg" "
  2⤵
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hn5we3.1mrzj.jpg"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1it1gnw.a5bt.jpg" "
  2⤵
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1it1gnw.a5bt.jpg"
    3⤵
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-okhygp.qzyxk.jpg" "
  2⤵
  PID:3368
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-okhygp.qzyxk.jpg"
    3⤵
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-lfgnfl.dxtmc.jpg" "
  2⤵
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-lfgnfl.dxtmc.jpg"
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-13a06k1.fvb1.jpg" "
  2⤵
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-13a06k1.fvb1.jpg"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-16zhrjp.osoag.jpg" "
  2⤵
  PID:1168
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-16zhrjp.osoag.jpg"
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-gjp8wq.i88k.jpg" "
  2⤵
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-gjp8wq.i88k.jpg"
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jr31sk.95mzg.jpg" "
  2⤵
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1jr31sk.95mzg.jpg"
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1r5ol5u.ufls.jpg" "
  2⤵
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1r5ol5u.ufls.jpg"
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mijgtw.c4nx.jpg" "
  2⤵
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1mijgtw.c4nx.jpg"
    3⤵
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-181envk.yw22f.jpg" "
  2⤵
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-181envk.yw22f.jpg"
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1t4hbny.twes.jpg" "
  2⤵
  PID:552
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1t4hbny.twes.jpg"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gxeoba.md5w.jpg" "
  2⤵
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gxeoba.md5w.jpg"
    3⤵
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-18j2fhl.33qi.jpg" "
  2⤵
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-18j2fhl.33qi.jpg"
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-udkw6g.jpm7.jpg" "
  2⤵
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-udkw6g.jpm7.jpg"
    3⤵
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kkb7da.pr4t.jpg" "
  2⤵
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kkb7da.pr4t.jpg"
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1nl5d5t.svj2.jpg" "
  2⤵
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1nl5d5t.svj2.jpg"
    3⤵
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1974ghs.xzfi.jpg" "
  2⤵
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1974ghs.xzfi.jpg"
    3⤵
    PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-k2rxix.zuru.jpg" "
  2⤵
  PID:4072
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-k2rxix.zuru.jpg"
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1h26krw.1eql.jpg" "
  2⤵
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1h26krw.1eql.jpg"
    3⤵
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-14g9uv.ulzmt.jpg" "
  2⤵
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-14g9uv.ulzmt.jpg"
    3⤵
    PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hoe9dh.ime2.jpg" "
  2⤵
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hoe9dh.ime2.jpg"
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gzy12t.yp87.jpg" "
  2⤵
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gzy12t.yp87.jpg"
    3⤵
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-4x2qcg.lvd9b.jpg" "
  2⤵
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-4x2qcg.lvd9b.jpg"
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-13ya8r.k3jqfi.jpg" "
  2⤵
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-13ya8r.k3jqfi.jpg"
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1931u1t.fxeb.jpg" "
  2⤵
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1931u1t.fxeb.jpg"
    3⤵
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-4571pb.unrj.jpg" "
  2⤵
  PID:3892
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-4571pb.unrj.jpg"
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bcnuh9.ge46l.jpg" "
  2⤵
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1bcnuh9.ge46l.jpg"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1aipkw8.v0nfg.jpg" "
  2⤵
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1aipkw8.v0nfg.jpg"
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-17a9yjn.0d15g.jpg" "
  2⤵
  PID:3296
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-17a9yjn.0d15g.jpg"
    3⤵
    PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-b53q5k.3zdad.jpg" "
  2⤵
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-b53q5k.3zdad.jpg"
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-15a1yde.rqh1.jpg" "
  2⤵
  PID:3276
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-15a1yde.rqh1.jpg"
    3⤵
    PID:184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-3vkrj7.7o71c.jpg" "
  2⤵
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-3vkrj7.7o71c.jpg"
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1csoy26.rq3gk.jpg" "
  2⤵
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1csoy26.rq3gk.jpg"
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1st7yc8.e8d6.jpg" "
  2⤵
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1st7yc8.e8d6.jpg"
    3⤵
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hn1amn.76p4k.jpg" "
  2⤵
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hn1amn.76p4k.jpg"
    3⤵
    PID:868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gmg7bj.2gqi.jpg" "
  2⤵
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1gmg7bj.2gqi.jpg"
    3⤵
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1qjj2j4.v1zg.jpg" "
  2⤵
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1qjj2j4.v1zg.jpg"
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-ammp6e.46c7.jpg" "
  2⤵
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-ammp6e.46c7.jpg"
    3⤵
    PID:3240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-lvltsk.zsoi.jpg" "
  2⤵
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-lvltsk.zsoi.jpg"
    3⤵
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-mit6k4.gmmr.jpg" "
  2⤵
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-mit6k4.gmmr.jpg"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-3ioxlz.psu44.jpg" "
  2⤵
  PID:1096
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-3ioxlz.psu44.jpg"
    3⤵
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1efjbv5.i8lc.jpg" "
  2⤵
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1efjbv5.i8lc.jpg"
    3⤵
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1iihipn.5wdc.jpg" "
  2⤵
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1iihipn.5wdc.jpg"
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kul7t.2zgrhh.jpg" "
  2⤵
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kul7t.2zgrhh.jpg"
    3⤵
    PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1tzq3bt.8xqd.jpg" "
  2⤵
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1tzq3bt.8xqd.jpg"
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hox4r8.sfdf.jpg" "
  2⤵
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1hox4r8.sfdf.jpg"
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-2oq7v0.yghfn.jpg" "
  2⤵
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-2oq7v0.yghfn.jpg"
    3⤵
    PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-19m1u55.lzu7.jpg" "
  2⤵
  PID:4144
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-19m1u55.lzu7.jpg"
    3⤵
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kzoq0y.c1te.jpg" "
  2⤵
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1kzoq0y.c1te.jpg"
    3⤵
    PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1p7kcx8.8ssi.jpg" "
  2⤵
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\202438-2012-1p7kcx8.8ssi.jpg"
    3⤵
    PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\202438-2012-1x019sj.nic2.jpg" "
  2⤵
  PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log

Filesize
862B

MD5
f3ac7a0e31b9af1b495241eff29915ad

SHA1
286fe23eba741cd3fca3f3e9a919021946655392

SHA256
f134296c53650817d3b2bbd04fd77b8833b76e79a953a1d14f7a3484bab5f12a

SHA512
b21d4e091140025f7ef2e96a3e3228c788ecffe43f4bcc5d1a15826686a392d9e0ad4ead4ed19b88c92fc9fd470014b15a79b9a82878d03005da3681b8dd9210

Download Submit
C:\Users\Admin\AppData\Local\Temp\03c91d8d-e645-4035-ac3f-04174885245b.tmp.node

Filesize
2.7MB

MD5
30af610789f7032760077d9c1197d0f3

SHA1
b57027046f9c7b3d4cda0aef5c8baa334b6fc339

SHA256
64d0ead558c2ad1676574a0603111bf683286ea151daa2733c64739764de4722

SHA512
457dfb6de5b0ea065a8736447c3d63eb70161dffb1a4b5e2e0f9cdc579c5422cf305ffa48f90a847c5d98cf7888cb7022494c4e280ba7fe49c1e3035a81ca0a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\202438-2012-14tdgzx.l2t7l.jpg

Filesize
82KB

MD5
de3b4935325b649bacc1aa2995e25170

SHA1
76e476ce1ca6e76cb1886996ca2ed241644308c7

SHA256
1032512cd6c1684a653e4321ba85f632cc39bcffa1ec14ed051e4d09751dbe8e

SHA512
5deb88be1c4dad6b9f27fd7ce5fadeb13d04378c02d51c3a615a41fed730d3aaf3835b311bac474d3332c9cb5652fc5344a3b497c917471e3707b3becfea7b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\202438-2012-1wyazbx.rqmoj.jpg

Filesize
82KB

MD5
05d18d3fcd567b5ea2a8c999d12da170

SHA1
9b99ddc8417d427cbbaa548a6a050e9964056b1e

SHA256
a1fb36000f9ad0e1ebd930b57df641a21730a844aea60fd6c3d3a40b33daeceb

SHA512
a912c8bd9e705733de2ce462ec05ff4396e89eb5dd3352a409f87c9df511df3e16940f42ce3406ee655e692bf5ff280a40c02274146f97576dececc984f051ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBC0C.tmp

Filesize
1KB

MD5
0543eee5312c838aa500c77ab7a88529

SHA1
588e5b8923a48010a8b823b626b82a2701d3b3c3

SHA256
8ff5a43e4a7547986d31471e11690fa79ff2c965c14bf4476503efcd19647d81

SHA512
a506850c3ba5a49b6d887a24fb32c45695a54198bd657cd6d3674d4ce8304f31173f63b4140ebf1502df9d69ea0b7f85833a6c665060a201afba01fc17e5439e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ee2d78e7-8cbb-45ab-8ca2-c0f42c0f3c40.tmp.node

Filesize
652KB

MD5
8982448cb4f28b82876befe6e8af25d1

SHA1
4d3b2fb5b42fc27c1ac9363003abc16ada188581

SHA256
78734316565f73b735bc3acb4c8bc6b41fe886ca20ee81e620dbea1e23e1fb38

SHA512
3edef33d5cd40f3432aeae603e725f0aacd6e7e387cc6723eac8d3030c3c78e43539a5e6e63c75a4acfd24e9c9fc8913d204ba6523be01ca31cca9a181a49a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

Filesize
240B

MD5
810ae82f863a5ffae14d3b3944252a4e

SHA1
5393e27113753191436b14f0cafa8acabcfe6b2a

SHA256
453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c

SHA512
2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

Filesize
13KB

MD5
da0f40d84d72ae3e9324ad9a040a2e58

SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Filesize
12KB

MD5
33448cb484144d9077b9e9bc3ebe0014

SHA1
0321c7db7114bab8ed36dbcf150955745281150d

SHA256
a62224a21aa8c4b70b6d0862239f88102c98e78889e8e0c40a2f82d40ccae1da

SHA512
158e8a3998802bafa30318c4ebda99a3be236bcc609fe30000bd4ac68bf29acdb7a933cfd7491f93cde5ab79f7e81ee2c73231f68ec3fc7cecf63b070532593e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC97E0769C437E403BB6AC9E80CDA8CD26.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

Filesize
350B

MD5
8951565428aa6644f1505edb592ab38f

SHA1
9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

SHA256
8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

SHA512
7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

Download Submit
memory/452-325-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/808-266-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1144-149-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1192-102-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1192-115-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1228-331-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1228-329-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1520-296-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1520-307-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1520-160-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1520-135-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1632-207-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1792-98-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1792-89-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1840-280-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1840-148-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1860-276-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1864-306-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1904-323-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1932-163-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/1932-136-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2080-107-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2080-99-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2396-201-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2512-206-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2548-292-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2548-286-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2660-213-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2676-321-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2728-324-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2736-720-0x00007FFE76180000-0x00007FFE764D5000-memory.dmp

Filesize
3.3MB

Download
memory/2736-215-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2740-152-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2740-134-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2744-254-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2744-251-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2920-275-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2948-330-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2964-536-0x0000025C96CC0000-0x0000025C97015000-memory.dmp

Filesize
3.3MB

Download
memory/2964-1117-0x0000025C96CC0000-0x0000025C97015000-memory.dmp

Filesize
3.3MB

Download
memory/2964-6-0x00007FFE76180000-0x00007FFE76181000-memory.dmp

Filesize
4KB

Download
memory/2964-124-0x0000025C96CC0000-0x0000025C97015000-memory.dmp

Filesize
3.3MB

Download
memory/2972-235-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/2972-217-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3276-273-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3380-293-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3380-297-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3440-153-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3576-175-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3576-162-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3772-210-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3780-277-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3840-328-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3840-320-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3884-245-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/3884-242-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4060-112-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4060-104-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4264-237-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4456-281-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4456-291-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4596-154-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4836-1013-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1031-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1026-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1033-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1029-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1024-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1014-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1022-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1010-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4836-1021-0x0000020DDFB90000-0x0000020DDFB91000-memory.dmp

Filesize
4KB

Download
memory/4900-214-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4992-103-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4992-90-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/4992-88-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Filesize
40KB

Download
memory/5036-322-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/5052-166-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download
memory/5052-178-0x00007FFE569B0000-0x00007FFE57471000-memory.dmp

Filesize
10.8MB

Download