Analysis Overview
SHA256
9c1a052b4f6fbbe3c6437b3af2a3f93f2218b3c175073e7daeb6361f999a94c5
Threat Level: Known bad
The file Ghostbane.exe was found to be: Known bad.
Malicious Activity Summary
Epsilon Stealer
Looks for VirtualBox Guest Additions in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Enumerates VirtualBox registry keys
Looks for VMWare Tools registry key
Checks BIOS information in registry
Reads user/profile data of web browsers
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Identifies Wine through registry keys
Looks up external IP address via web service
Adds Run key to start application
Checks for VirtualBox DLLs, possible anti-VM trick
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Enumerates system info in registry
Enumerates processes with tasklist
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Detects videocard installed
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: CmdExeWriteProcessMemorySpam
Kills process with taskkill
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-10 18:39
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral14
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:44
Platform
win7-20240221-en
Max time kernel
122s
Max time network
134s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
Network
Files
Analysis: behavioral28
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:44
Platform
win7-20240221-en
Max time kernel
118s
Max time network
132s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2212 wrote to memory of 2224 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
| PID 2212 wrote to memory of 2224 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
| PID 2212 wrote to memory of 2224 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2212 -s 84
Network
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
120s
Max time network
127s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 224
Network
Files
Analysis: behavioral8
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
57s
Max time network
156s
Command Line
Signatures
Epsilon Stealer
Enumerates VirtualBox registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Looks for VirtualBox Guest Additions in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Looks for VMWare Tools registry key
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Wine | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Reads user/profile data of web browsers
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
C:\Windows\System32\Wbem\WMIC.exe
wmic CsProduct Get UUID
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=gpu-process --field-trial-handle=1644,1720411707240764412,11718900805635595287,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 /prefetch:2
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,1720411707240764412,11718900805635595287,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=1864 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1644,1720411707240764412,11718900805635595287,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2356 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
C:\Windows\system32\taskkill.exe
taskkill /IM chrome.exe /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
C:\Windows\system32\cmd.exe
cmd /c chcp 65001
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1644,1720411707240764412,11718900805635595287,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=2580 /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x3cc
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1l9fwl3.cenv.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-if6f0i.kixp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-85twkj.v07a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iigapo.fae4j.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62C1.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC780015F7E494BB994C28D65C7C3209A.TMP"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-u9nckm.j7uba.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1vspewo.xbnq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17kir61.kkr8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-79zh7r.slw7u.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1l9fwl3.cenv.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1n8rq1y.g9ce.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ataqih.cpwc.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1enifma.bnop.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-o4jbku.8v38.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4ms9u3.5wq0k.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-if6f0i.kixp.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1uba5i0.ydum.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-18shcqq.mlsh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1hegdnk.sz62.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-85twkj.v07a.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-v3mqsj.43c4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6wz9le.3vv0g.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5o8dk0.dbahe.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1k3bwaj.u84t.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-xn51e7.7myd.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iigapo.fae4j.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-16zeffi.rdjcl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1dbflcz.wcvh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1w3zq8d.u5ksf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-lb6b93.6xcha.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-n1bbab.cp3g.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1765mx9.xnbf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-12rqmbr.buen.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1cwulou.8938.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1i1aeni.0ug.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1hsuiwn.3fls.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1n8rq1y.g9ce.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-syqfl1.8z8n.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5txhqu.pu1eo.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ml0784.301d.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-mc7cpj.z7k38.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-13gr5bd.aftj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1uddtpa.rq52.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6h7spf.vgnmu.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-9svxh2.594qv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-in4g9k.lde8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-eauqv4.2vsvq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-jqy5fd.hn7hb.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5o8dk0.dbahe.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1rkbihi.9pdvi.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1k3bwaj.u84t.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-n3z3z7.vuh3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1j66x2a.2tnte.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17sznkh.zcqo.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-g8i56s.eh9e.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1rimwzs.48qp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1v6rn89.kqu8h.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-16zeffi.rdjcl.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1dbflcz.wcvh.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qq1jo.xxpk7i.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1s34zy4.h0ut.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qvrswi.wgs1.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-dpzyi3.dgef9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-133yzen.9kou.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-urr4q7.nb4s.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-19uqkzy.80roi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mh62ue.t3p3.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17ojqxn.iqxg.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-12yhq5u.hdhz.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1x6d1qm.choki.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1cwulou.8938.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1hsuiwn.3fls.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ch2adr.sjnf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-169lluq.9fag.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1aag1d3.vs4t.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1i1aeni.0ug.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4ccv7w.20q74.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1hx4vrr.azn9j.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17oo4gy.1355.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qonk3i.malc.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-dpds55.vgcv7.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-i5x30c.uq87f.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1bzabfk.esom.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4rk0o4.dk2cm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1b3zfuc.510i.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5bspjs.nxyby.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1xtjk5z.8ujv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-9e3erd.mj1gq.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-16na98n.kw2y.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-170sy78.40ui.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ohrq9i.yod8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mmq3hd.1zpef.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-eosojz.fjvpl.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1oacnmt.m4an.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-51v5i6.9er.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-syqfl1.8z8n.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-13dknyv.df2gj.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-10cry1f.44hy.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-2xyfmm.yrbdw.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-pghzic.0jq1n.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5txhqu.pu1eo.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pwykuo.s34r.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-oqwa7w.o4j6d.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ml5tpn.e8td.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-mc7cpj.z7k38.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-169ab6t.prgt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ucs7k9.m4bt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mdpw0b.0jzz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1bsb21v.wsz2.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-13gr5bd.aftj.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-fe4rec.y7gmh.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qu9h8d.0q669.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ml0784.301d.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mflpou.cen9.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1i6sht6.2ja9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pqg1fl.dex6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iuplr8.f54pn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iyt8s4.omf7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1e0086g.879i.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nnr7m7.u6k4.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ew9mx5.yeq7h.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17rgm46.4g5m.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-vxp0yp.br7un.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1xt5m80.1dxy.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ang273.2afp.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-14sr5dw.gv1b.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1v7rw8m.i4l9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-15simnz.jtk6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-t74jdo.s4vnr.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-g93kfa.1k2jk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-m7nko0.bv22.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1x0eqv8.3wf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-pgphvm.v6zc.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1spavr8.zcuz.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6it5kv.fjvcs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1c72rgm.3plih.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-eauqv4.2vsvq.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-yucz9s.arq5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1s2un3i.o1zb.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-jqy5fd.hn7hb.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1uieh9m.npub.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1yua0od.6ij8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-titnna.0mdhi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qeeu1h.4y7tb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-152713i.hbqm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-18s9uxo.e4bg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-n3z3z7.vuh3.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1rimwzs.48qp.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-18ocmy0.4idz.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5x5894.7nq7u.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1v6rn89.kqu8h.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1to6xa.zvhjt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-wz4alf.me69.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6dcdzi.hjrao.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nm4pxt.vxgw.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-11wfsfx.9my5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-9h5wg5.323w5.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-19kb5i3.mrcn.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-s2qx0w.k1f7c.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1kl5v5f.jwkz.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1r8lrcf.fwa3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-187n5j2.5yyx.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6n0dcm.7xvca.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-3ifov6.fpagp.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-gf4jgw.8rga.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-172705b.j8bd.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-dpzyi3.dgef9.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1rkbihi.9pdvi.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qvrswi.wgs1.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-13g4ggt.dkv8.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-133yzen.9kou.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-p0iizj.gjbjt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-liwq7a.hu67h.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1c5bv5m.fsof.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-11gkwur.e1uv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-19uqkzy.80roi.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-135fy7m.q2jhi.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mh62ue.t3p3.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1oq1k6u.l1m7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-14giqv.n62b6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qvt7r1.fcgqr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-z56cz9.jqsol.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-i8jw00.vlo3s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1q6wou7.flt.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-cjupcy.9n0sv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1s34zy4.h0ut.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4ccv7w.20q74.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-10kuyit.l8nuj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1aag1d3.vs4t.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17sznkh.zcqo.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-llzq71.54yhk.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1x6d1qm.choki.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1j66x2a.2tnte.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-drkxz4.cci9r.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-zoynzu.pcj5.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17oo4gy.1355.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1th8vtm.3ohs.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-hoo8p2.7fyav.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1xxcyvv.gzut.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-g8i56s.eh9e.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-q0fccj.8mivi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4uzlup.hhs8l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1k6vdam.fwmg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ad82rd.7nh5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-k1x8i4.p87us.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-r4i97i.6yu09.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-170sy78.40ui.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-15rg6xn.2sij.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1b3zfuc.510i.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-bcuhvn.tyxd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nj1sg0.96cu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-3v43jc.4bqt9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1wj4yu4.8rtj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qonk3i.malc.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-l6mt7z.kwjpm.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-10cry1f.44hy.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5bspjs.nxyby.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-oqwa7w.o4j6d.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1oacnmt.m4an.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ml5tpn.e8td.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-pghzic.0jq1n.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mmq3hd.1zpef.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-xc0qrq.157jg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-169ab6t.prgt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pwykuo.s34r.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-w76vlt.xcoz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-yjqw9u.ceol.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1sp6gg4.9ey6.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ucs7k9.m4bt.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1d7hcui.wv9e.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1lutk9y.j78v.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pqg1fl.dex6.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mdpw0b.0jzz.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-sjevzy.cf2s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-nv89vo.20qab.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nnr7m7.u6k4.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-oi180i.5lp98.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1e0086g.879i.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qnw3c0.4nnx.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pj3wzt.ohy7l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4ldqhm.5p8v8.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-vxp0yp.br7un.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1xt5m80.1dxy.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-i5x30c.uq87f.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1bsb21v.wsz2.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ch2adr.sjnf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1v7rw8m.i4l9.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iuplr8.f54pn.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-jhy7tj.2tdg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1hx4vrr.azn9j.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1caulf6.pynlf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iyt8s4.omf7.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-q7pu25.bih2.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4rk0o4.dk2cm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-7a872t.d0c4l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ajjlqg.1aep.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6it5kv.fjvcs.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-172yz4e.gn7r.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-16na98n.kw2y.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-l4ev36.pq62.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1yua0od.6ij8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ujz9ma.glla.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1j78t6z.3hft.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ohrq9i.yod8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-kkdmfb.ejudq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-vq1a7y.fxml.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-titnna.0mdhi.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1s2un3i.o1zb.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1cwetjl.xlmg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-yucz9s.arq5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-16gx7lj.xwnz.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qeeu1h.4y7tb.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5r0gvw.5qcou.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-oibpgs.yz1p.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-152713i.hbqm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-14hxd4r.788u.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1lmyzv1.7njo.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-18s9uxo.e4bg.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ry2ik6.x6v.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-18ocmy0.4idz.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-15simnz.jtk6.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1te34aq.dfloi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pa3fs8.man.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qfipbh.x7mc.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-wz4alf.me69.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-160r3o6.beh9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-lb359y.g000d.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6dcdzi.hjrao.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-6uvurr.444tc.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-t74jdo.s4vnr.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-14230y1.a333j.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qzi8d0.byro.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-m7nko0.bv22.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-16dtl1w.q4zv.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1to6xa.zvhjt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1x0eqv8.3wf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1r8lrcf.fwa3.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-187n5j2.5yyx.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-to5ixz.uhkar.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-j3umpa.w3c8t.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-13g4ggt.dkv8.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-172705b.j8bd.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-gf4jgw.8rga.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1inerxr.c3v4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-60pfd8.83z57.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-giii1i.j1il9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1b1yln4.9uoj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-2qu9fc.xm7el.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1uieh9m.npub.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-187dyf3.9qr6.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1oq1k6u.l1m7.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-e6kq4s.bpfk.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1c5bv5m.fsof.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1c72rgm.3plih.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-9h5wg5.323w5.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qvt7r1.fcgqr.jpg"
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=gpu-process --field-trial-handle=1644,1720411707240764412,11718900805635595287,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5368 /prefetch:2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1a9q4uu.3yi3i.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-i8jw00.vlo3s.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-19td6qq.ia1m.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-liwq7a.hu67h.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1038004.lhsr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-43exxw.llwni.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-p0iizj.gjbjt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-drkxz4.cci9r.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-cz38lh.4ro3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-qgpbzz.ri13.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-z56cz9.jqsol.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-llzq71.54yhk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-15v2imn.iyzn.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-10kuyit.l8nuj.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1t44c3r.cok2.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-14giqv.n62b6.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1xxcyvv.gzut.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-nhcac2.ujwb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-iqss8s.0l00b.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1mo2vex.q7o.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1cuo18i.umm5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-10g9329.h936.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-k1x8i4.p87us.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1k6vdam.fwmg.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-sqwjvu.np4wo.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-q0fccj.8mivi.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1n6tzs4.6bsg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-dec4qu.009e.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ioux59.k8pjl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1k54jn7.ilgm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1wa7zsv.540a.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-r4i97i.6yu09.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1xed9jh.moki.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-p2aq3x.ndbhs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-9957nn.4r6f.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-bcuhvn.tyxd.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-165sr8a.za7m.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-14fmde7.4i2o.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ad82rd.7nh5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-o0452a.kal8.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1q6wou7.flt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nj1sg0.96cu.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-ki750e.q5emh.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-3v43jc.4bqt9.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4uzlup.hhs8l.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-zoynzu.pcj5.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1wj4yu4.8rtj.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ophh1o.d7dsh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-196tso4.vub9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-17i9mtm.ptfyl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1q7yqwt.deq5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1oemjpn.jzsx.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-5c0imu.ei5to.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-l6mt7z.kwjpm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-dt44qf.kg0ya.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1sp6gg4.9ey6.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-zpaqf9.muye.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1t872yd.zc7o.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-yjqw9u.ceol.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-m0mh56.rxmqr.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-w76vlt.xcoz.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1d7hcui.wv9e.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4gg21.hdfpf2.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1k5wwsr.iz0xm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nctmbk.wz7el.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-zmr6f4.uiyg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-dkh58r.r7pva.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-sjevzy.cf2s.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-nv89vo.20qab.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1pj3wzt.ohy7l.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-958owx.yj3rh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1yg8hcs.yb3kl.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-xc0qrq.157jg.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-oi180i.5lp98.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1qnw3c0.4nnx.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1nahclu.d7hr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-10nj4nt.ir8d.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-jhy7tj.2tdg.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-4ldqhm.5p8v8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-40s3i8.nvvg4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1wld0xn.nm9oh.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1caulf6.pynlf.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-bn9oki.dn4ca.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1hbl16m.rsvg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1g0t7dy.cboc.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-1ajjlqg.1aep.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-lcf0j4.ht0lt.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-7a872t.d0c4l.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1208-damzzl.y2w1e.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1208-172yz4e.gn7r.jpg"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | 192.186.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | panelweb.equi-hosting.fr | udp |
| US | 172.67.176.119:443 | panelweb.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | panelweb.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | whoevenareyou.equi-hosting.fr | udp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 119.176.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.40.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.8.8:53 | 4.4.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 159.113.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.223.142.52.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 28.143.109.104.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\da7990e9-0f52-4150-a5db-9e52b363f6e8.tmp.node
| MD5 | e4c111d47eb54b62dab8cb12540b9e39 |
| SHA1 | 09be3e7d9eec1853dc628c8c3b90e7b670921029 |
| SHA256 | a05338fe1e0eb08230717ad2f3587a5c1cb4bd10a673c40a3059f70ae0e7e6b1 |
| SHA512 | f9ec1e62c08425382b48320d2fb1a7fa412dea84825cc49b0297d5c6cfdcb80f32c54de28ac59e7a4c7557ae9900a8d3860fc7d23e486bcc28e603787d9f0f79 |
C:\Users\Admin\AppData\Local\Temp\e46d2377-5e6a-44af-8d6b-77d4af658d78.tmp.node
| MD5 | f1e751eb4dbfa4a1b5f4903315fc535a |
| SHA1 | 85e1166819678f839954c473d7eb363a99e24a96 |
| SHA256 | b8c24de2fa870ceb677f30da0eabdf20745d0a9ebed98f49c52d881383c75096 |
| SHA512 | 2349745a84bc2b2f9c2b96999d48e37242a6c3627d7898cd9a36e682e36ec12553713db7167b3a9cd20ec308ce11d84f09f06beb3e971823d8b4a959f457b182 |
memory/4484-12-0x00007FFE193E0000-0x00007FFE193E1000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Temp\955715bb-ba82-41c3-9a89-c34dcea23122.tmp.node
| MD5 | d4e6004197508892d18fc47645b25f62 |
| SHA1 | 1afceda2531e593c00de7ab994f928a150de5b4d |
| SHA256 | dc29d32decbd161ea4ff1e645d3fdf7a1ce3db0ee25e5485bc19fc775922b71c |
| SHA512 | 0be017eaba3764eb9f38e78248528a9e025958e713a8eb4a8f9b03d087267e107ceef8525a4ecfcbb684b077145fb0161e5dbe05f9fd95f8f94a140fe3ceb8a4 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt
| MD5 | dec2be4f1ec3592cea668aa279e7cc9b |
| SHA1 | 327cf8ab0c895e10674e00ea7f437784bb11d718 |
| SHA256 | 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc |
| SHA512 | 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
| MD5 | 810ae82f863a5ffae14d3b3944252a4e |
| SHA1 | 5393e27113753191436b14f0cafa8acabcfe6b2a |
| SHA256 | 453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c |
| SHA512 | 2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112 |
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
| MD5 | da0f40d84d72ae3e9324ad9a040a2e58 |
| SHA1 | 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f |
| SHA256 | 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b |
| SHA512 | 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9 |
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
| MD5 | 8951565428aa6644f1505edb592ab38f |
| SHA1 | 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2 |
| SHA256 | 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83 |
| SHA512 | 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5 |
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC780015F7E494BB994C28D65C7C3209A.TMP
| MD5 | a6f2d21624678f54a2abed46e9f3ab17 |
| SHA1 | a2a6f07684c79719007d434cbd1cd2164565734a |
| SHA256 | ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344 |
| SHA512 | 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676 |
C:\Users\Admin\AppData\Local\Temp\RES62C1.tmp
| MD5 | ca0e22caeefdf41df340b5f2da7e3165 |
| SHA1 | 38b76d6b0b3354a4a8d405fdc233648d4e8f99e1 |
| SHA256 | 1dd790061589aa2250f8cd9defa35b4834814e6a5c25ff5e79b7cde74424d80d |
| SHA512 | 1d88c48d4e68d70d4ae75dfc248adf6d65ce8b31d3e0498d9d6fdb70ac2c2585a4070a948d13d5422112be5288545f99b6468d9ff1930f9aea3c4038c9a85ca4 |
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
| MD5 | 84a054eae4c7fcee21feba7a531f384d |
| SHA1 | e706b743d9aa04896358675123ef3835570061c6 |
| SHA256 | 42f4683f72ab39ef7cf7739348c6ad4e1165ae398adbc2394277c44f2779f694 |
| SHA512 | c4b9d6bb629d74ffeb1b8bdf50c35012fe7c2d02c3062ab74962630c3b4187bc029527e18471cca8f2c0782edf5251a6ea1a56dcad7f7d8d45aee8936443afe8 |
memory/3212-137-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/3212-145-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log
| MD5 | f3ac7a0e31b9af1b495241eff29915ad |
| SHA1 | 286fe23eba741cd3fca3f3e9a919021946655392 |
| SHA256 | f134296c53650817d3b2bbd04fd77b8833b76e79a953a1d14f7a3484bab5f12a |
| SHA512 | b21d4e091140025f7ef2e96a3e3228c788ecffe43f4bcc5d1a15826686a392d9e0ad4ead4ed19b88c92fc9fd470014b15a79b9a82878d03005da3681b8dd9210 |
memory/4484-149-0x000001DCA2D30000-0x000001DCA346F000-memory.dmp
memory/2212-152-0x0000018F99AA0000-0x0000018F9A1DF000-memory.dmp
memory/2300-161-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/3892-165-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/5480-172-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/5780-178-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6000-194-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6360-219-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6172-223-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6368-235-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6636-245-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6796-253-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2024310-1208-1vspewo.xbnq.jpg
| MD5 | c87e8e11efcf9b8fd2550f467802a3c7 |
| SHA1 | 0d41109d7d3529521884fbbb6455fb82272c1b9b |
| SHA256 | e4963d6ba460643d3a85693c6385ec6b873773e1021a5c170660abdbcebb9d85 |
| SHA512 | 260dc7b038def6c8988dd66c40c17035f3949e46c4d2542186789283c55ffbc31150c583cf976a1c6a6def52fda1f610acfc7f3ad0781f85b43ec5d8d7652d02 |
memory/2592-291-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6980-310-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6816-314-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/5992-309-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6556-332-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7360-343-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/8096-362-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/4680-383-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/8156-379-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/8176-378-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/5628-374-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/6836-375-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
C:\Users\Admin\AppData\Roaming\Ghostbane\Network Persistent State
| MD5 | 5931ed6cf39f49773ca16f61403dddd7 |
| SHA1 | 26433a484998a1423ed4cc6bdac0839544e8ed3c |
| SHA256 | 112a623a3b1c736803a99fbcd09ec60d20fb8e67a1a4666d304275b6cb576db4 |
| SHA512 | 9f334c6fea4b6803ab0f48bbb24cf7dce67de8b7271bcd2c286d1a8364fdc8004d6627408d8a4ae92fc9739c31433c4394bd4d0820f91cbe74c0be7ddff2514e |
C:\Users\Admin\AppData\Roaming\Ghostbane\Network Persistent State~RFe587af7.TMP
| MD5 | 2800881c775077e1c4b6e06bf4676de4 |
| SHA1 | 2873631068c8b3b9495638c865915be822442c8b |
| SHA256 | 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974 |
| SHA512 | e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b |
memory/7040-894-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-884-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-879-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-869-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-898-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-901-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-921-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-931-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-907-0x00000261DB570000-0x00000261DB571000-memory.dmp
memory/7040-910-0x00000261DB570000-0x00000261DB571000-memory.dmp
C:\Users\Admin\AppData\Roaming\Ghostbane\Network Persistent State
| MD5 | e826db475d8d912671ee714fd1048b48 |
| SHA1 | 074c1fa15aca2edb3c880a34add1c819b64efd7e |
| SHA256 | 33f67878d92e87a2f14cf3f6b3761a58015da1043d4929e9399172c90666d67c |
| SHA512 | 8e0806b993e75b21ec1e8612e0fc7c23160d1299b3b25774c8ffb9fd3800c5d44561907fd546c6138846f131f02cc53a440b98d70f081cf128441f7af4c59f8b |
C:\Users\Admin\AppData\Roaming\Ghostbane\TransportSecurity
| MD5 | f476681d7e1967a5bc46393e9d969c69 |
| SHA1 | 4a6d6443a47d6e962cc6aff0ea8f8572959d25ce |
| SHA256 | 2138fd7254a5ea76ad9de880eefb605f39ae58d4b5bde919041a613e4c13ee21 |
| SHA512 | ee4f2c1c5574733e6ab41a857588484b37108e3cdd17d759dedd5514fb91ef5b3794fb39d3238d4c8226065510221ab683993ed978f95d40098d5a4198f5debd |
C:\Users\Admin\AppData\Roaming\Ghostbane\TransportSecurity~RFe589045.TMP
| MD5 | 7c64fffa85edc37e9d28f8c7c3fd782a |
| SHA1 | e143ad5ebe576fd9cc12bbcc9499a3912c7bd587 |
| SHA256 | b0e925b3f995fac102534624660ba3019e3e77b92f99ac63c9dda0317b1b388a |
| SHA512 | bc880a37dced61840c3d75477c6fb5e4376192e354d22423b7da9142408c0f66a9410d50b8833948a94d08728e554482371187f85e8fae7ab92aaf5b12d0c4e0 |
memory/8156-363-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7380-358-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7224-357-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7676-355-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7380-351-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/8096-345-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7488-344-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
memory/7676-333-0x00007FFDF86D0000-0x00007FFDF9191000-memory.dmp
Analysis: behavioral13
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:44
Platform
win10v2004-20240226-en
Max time kernel
137s
Max time network
169s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3276 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.178.10:443 | tcp | |
| GB | 23.44.234.16:80 | tcp | |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 159.113.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.171.91.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.143.182.52.in-addr.arpa | udp |
Files
Analysis: behavioral7
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240220-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
Epsilon Stealer
Enumerates VirtualBox registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Looks for VirtualBox Guest Additions in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Looks for VMWare Tools registry key
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\SOFTWARE\Wine | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsUpdater.exe" | C:\Windows\system32\reg.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
C:\Windows\System32\Wbem\WMIC.exe
wmic CsProduct Get UUID
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=gpu-process --field-trial-handle=1076,13670804180163414550,5075856159375506659,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 /prefetch:2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
C:\Windows\system32\taskkill.exe
taskkill /IM chrome.exe /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
C:\Windows\system32\cmd.exe
cmd /c chcp 65001
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1u7rer0.j4c9.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1du6bbg.wdayk.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B1D.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC37AF23513E3948838ED824B4512EF38.TMP"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BB9.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC7D2320B16B524779A0C18E2D6EE57E46.TMP"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1u7rer0.j4c9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-khzcq2.pfos.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-khzcq2.pfos.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1wdnggp.41ma.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1wdnggp.41ma.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ab6n1y.g6s0o.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ab6n1y.g6s0o.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1mh4dtw.t88a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dnyzr.v259mk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-12o5igr.6su6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vwzkq.66tei.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-10enhg7.ovnb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vuldd6.3zk5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zcno5u.olwdc.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dcpilx.hlcal.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16hv35c.8qqf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-w9sptm.fstt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ip9avl.iqun.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-q2gst6.7aixc.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-13lmt65.v8f8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pbcs9d.xp5m.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vaho3z.0i0q.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-v3lk1g.d2tam.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-tkpck1.1bfu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-clwpkg.viaeu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-qs64wf.r666.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1y9e5pe.m09l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-3hthk3.b7ukq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-19tvo2y.3wvzj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dv21bp.0ac1.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-14wmg3w.wrd1i.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1mh4dtw.t88a.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vaho3z.0i0q.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pbcs9d.xp5m.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8o68hs.6ud2j.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zcno5u.olwdc.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dnyzr.v259mk.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-v3lk1g.d2tam.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vuldd6.3zk5.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dv21bp.0ac1.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cd0rpy.txo9.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16hv35c.8qqf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dcpilx.hlcal.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ip9avl.iqun.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-q2gst6.7aixc.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-13lmt65.v8f8.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-3hthk3.b7ukq.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-10enhg7.ovnb.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vwzkq.66tei.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1y9e5pe.m09l.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-12o5igr.6su6.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-19tvo2y.3wvzj.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-clwpkg.viaeu.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-w9sptm.fstt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-tkpck1.1bfu.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-14wmg3w.wrd1i.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-qs64wf.r666.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8o68hs.6ud2j.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16temvu.3rg9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1beaipq.m3lv.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-iq0a20.y0yo.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ptxwg.6xr4a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-iboykv.igle.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8e7dmd.yhbfa.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16kyg0b.e4i9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-v0e576.ygd4a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ecm7wr.122iv.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-12dpzn1.ddpv.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-tv9k85.ksie.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-173qbqu.bga4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-f1bamm.lx7s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-n7sv7i.jaa7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1m86355.k2nu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ce2tll.522y.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1bwmx7r.638t.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-10scdu5.pf45.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-wm0gcc.ezmxm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1c8r5iy.ir9v.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-112az7g.ivl8l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pm4ba.psl2y.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pl49fb.ejudq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1f5w0y6.ipri.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-kxqvz3.azy4d.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9c9orq.gf8bf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1au5dvp.4ydlj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8k28fk.ed2i8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8dw6dt.90l9o.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-5hu0pz.92at.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ldpldz.ghi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-150no9q.ofif.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1iq1lip.9sc6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-146djf1.9lvx.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ydt36l.81ofg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1beaipq.m3lv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ptxwg.6xr4a.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-iq0a20.y0yo.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-10scdu5.pf45.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vme4om.mt1tr.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1m86355.k2nu.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1bwmx7r.638t.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1c8r5iy.ir9v.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pm4ba.psl2y.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-wm0gcc.ezmxm.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ecm7wr.122iv.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1w40yrj.svm1.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-173qbqu.bga4.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ce2tll.522y.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-12dpzn1.ddpv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8e7dmd.yhbfa.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-112az7g.ivl8l.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-f1bamm.lx7s.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-n7sv7i.jaa7.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-tv9k85.ksie.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-v0e576.ygd4a.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16kyg0b.e4i9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-11nhr0n.hle6.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-146djf1.9lvx.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8k28fk.ed2i8.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9c9orq.gf8bf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1f5w0y6.ipri.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1au5dvp.4ydlj.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-5hu0pz.92at.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8dw6dt.90l9o.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1iq1lip.9sc6.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ldpldz.ghi.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-kxqvz3.azy4d.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-150no9q.ofif.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tvewxs.9ju2.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-c5zd6r.0mi0w.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1i0ek95.74k7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1iyovof.sqnu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pipb5r.jpyfd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-sbmigo.z8e3.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tvewxs.9ju2.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1w40yrj.svm1.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1y1t2mc.8b8v.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-j6kedb.jy9sb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-hcdvkg.ok3l4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1bcz4wz.4ozpf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-3kuqsy.nuvd1.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-11clkci.ktbt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1b8zha9.dqmm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-102hpi3.b9a4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vh51ow.0mdg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ud9kpf.m4do.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1sn1mne.x5lr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1k5zna4.bgkz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-3du732.bdk6o.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cd0rpy.txo9.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16temvu.3rg9.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-iboykv.igle.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pipb5r.jpyfd.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ydt36l.81ofg.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-7g9e4a.1b1dk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-94mrfx.4gaqb.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vh51ow.0mdg.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-c5zd6r.0mi0w.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-sbmigo.z8e3.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pl49fb.ejudq.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-3kuqsy.nuvd1.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ud9kpf.m4do.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-fyqgi0.es59.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-102hpi3.b9a4.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1b8zha9.dqmm.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1y1t2mc.8b8v.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1bcz4wz.4ozpf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-11clkci.ktbt.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-x8hl26.azo0r.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-gdgwrv.imcia.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vme4om.mt1tr.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-dpggnj.lkr1t.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-hcdvkg.ok3l4.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-blcecm.g2um4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-c68qjr.vwpeb.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1k5zna4.bgkz.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1sn1mne.x5lr.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1i0ek95.74k7.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1iyovof.sqnu.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-swb0et.e5xi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-mbotgo.4frgq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-sd90ot.uwcd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-a4uasm.m0f4.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-j6kedb.jy9sb.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-4c75p7.6zznj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-igo79w.ddhn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1w9t853.awnd.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-x8hl26.azo0r.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-gdgwrv.imcia.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-jtusbs.wayk.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-blcecm.g2um4.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-3du732.bdk6o.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1p34w63.mx55.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ap901o.mgyra.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-11nhr0n.hle6.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-4htl92.3bvsu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1n5y020.8ousi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-p1puf3.kkan.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1k6eja.slilo.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1x1f4gf.387z.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-6wr98.yxome4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16wg3ba.zb91f.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-390c9w.7atk6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1acnast.ajkm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1sqnma4.v9zy.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-t87fin.4cdf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-nw84a5.7xdjk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-gff7rd.zef2v.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1nhqiyf.id7yj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ss6c5y.s0ti.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-r6fd0h.9km3.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-c68qjr.vwpeb.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-24plac.sp4kk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1mle06j.xktp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1eaqx8k.j7cak.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-swb0et.e5xi.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1jo4fvi.kn8g.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-fyqgi0.es59.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ot34ni.j2x5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1wvgau0.h7xck.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-hsm4zr.gwol.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-sluunz.0gydl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1yohc50.150x.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-oxy8ox.j04hm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ky7ye2.ou3i.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dz485p.y3fck.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-asfu0j.zv4ih.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-19vfi40.bvdpj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-a4uasm.m0f4.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-bmb979.onw6o.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-py99cz.echgk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-os8y1n.er9m.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-4c75p7.6zznj.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1acnast.ajkm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1hzewzx.pn9w.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zrxgs7.cksb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-2wfgcx.3ch8x.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-cumqfe.nt8zh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ngexgi.cue5i.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-mbotgo.4frgq.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-hnvqtn.vt35t.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-gff7rd.zef2v.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vpywcf.ekms.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1p34w63.mx55.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1rckuao.twht.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-4z1ngk.cy7bv.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1lqkr4c.c9qf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-d6xjod.vs3kd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tdb961.1e63.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-122umo.q1u7o.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vzar7b.64n5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-wrho9a.6tn9h.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-sluunz.0gydl.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-iscya6.ri2p.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-7tuz4k.5s74c.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-nw84a5.7xdjk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-6tf34f.4m3ge.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-tab81q.c1309.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-7cau57.b587a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dghv2c.g5sn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vanw6u.hzor.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-11xlbbl.z1b9.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ap901o.mgyra.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9jbsmp.s1of.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1udz4i4.ctwm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-s2y6hd.d3a4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-no9a67.a31oa.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1w684ng.nvyng.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-s9rhcb.1f0nd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-aeh08b.bv4er.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1rhu43t.lz8z.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-dpggnj.lkr1t.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-t87fin.4cdf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-jtusbs.wayk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vhl206.50m5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zzphrh.pq6w.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-asfu0j.zv4ih.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ydnrir.ubuie.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-6mp68s.f2e4.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ot34ni.j2x5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-l4m7nl.b48h.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1j5rm0r.3s9j.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-6wr98.yxome4.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-17qeblb.xcx7f.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-wf7140.31cj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1yohc50.150x.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-abw7l.mbk1s5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1q21xsl.y4ao.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-w2vazf.hptoc.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-wj7ooj.xg5h.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1ahsa4j.mejwk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9dy76v.19kp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-hx6nwu.ndpws.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-loskf3.tittk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1q6nen2.a0r3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-petywc.9rf4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1bb43z7.2fpp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-npkcw9.si3z.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ngexgi.cue5i.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vzar7b.64n5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1g90ih4.9w7.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1nhqiyf.id7yj.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-225u59.mbp4e.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-70l745.wy9l7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tnaokm.hbni.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-os8y1n.er9m.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dghv2c.g5sn.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-aangyq.kvm5v.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1dz485p.y3fck.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1aap2hr.osr3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-u3hcrk.fyyrn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-l5cfm6.7v8e.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-qizlds.po5b.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-cumqfe.nt8zh.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-eghftc.fuhyq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-xx86jo.ir6nr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9wm2n0.txz5b.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-tab81q.c1309.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tdb961.1e63.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16whqbr.v4ge.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zxyfle.ax1f.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-15581lr.qs50i.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1keeo5a.1jxe.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ogr6kv.a2ylr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-13ee5oe.69d7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1rptwtd.xi32.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-h4wu5o.73rpv.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ss6c5y.s0ti.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tvpf8r.6gky.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-76xr4j.qo6jj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ky7ye2.ou3i.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1n5y020.8ousi.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-z3c8wm.sp3a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-499t5e.m0nng.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-bmb979.onw6o.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1n061jg.2tyrg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-70l745.wy9l7.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-pbe7lu.m0t3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1p2vctk.ewfn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1hejbf3.s8h7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-txjeuo.gbd1s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1p3xr74.af8ci.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-kk3cvw.kvy.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-19vfi40.bvdpj.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9aeas2.owubr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-i9f4e6.a8ri8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vqn606.m0rz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-17iyicf.u5ir.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-k4ne4t.dlga.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cce7sl.tevxf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1yd6t6f.cq1b.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zrxgs7.cksb.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1r64l0h.3xg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1rlf0mv.0tyk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-slubic.0gc8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-mlwh47.n0exb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1qbdh9q.x66xl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1yd9g2h.vp7mk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-8cytxj.c2vqw.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-390c9w.7atk6.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1nnjd63.irnh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-12taphj.h72qj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1j5rm0r.3s9j.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1xgmg5r.j64f.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-ogr6kv.a2ylr.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cx7atg.tyc7.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1tnaokm.hbni.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1q6bbyt.7x13.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-w1fj9j.h72ii.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1vanw6u.hzor.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1k6wfjo.tbxf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-50utzs.syj9i.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-7cau57.b587a.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-17qeblb.xcx7f.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-a7u5fd.lkjw.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-4htl92.3bvsu.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-qdoo2c.pmivo.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-kk3cvw.kvy.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-sn8fne.za8wr.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-225u59.mbp4e.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-197m1py.qzww.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-gt7l6b.pbeyn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1pjyvew.hw0v.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cgtcio.s4ee.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-k4ne4t.dlga.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1k2a7ar.yne2k.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1rlf0mv.0tyk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1y0soj6.zm3u.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-h4wu5o.73rpv.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-h43qqg.z7hs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1sjgmdv.tiv9.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1rptwtd.xi32.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1wxxh7f.ljgli.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-cg352x.g25u.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-zgr80n.wgox.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1o0uihj.qh2vk.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1p3xr74.af8ci.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1nnjd63.irnh.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-fxwim6.vtkii.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cxbf6r.wr8y.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1cce7sl.tevxf.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-6qdz4z.s714i.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1q6nen2.a0r3.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1y99jmz.av1k.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1keeo5a.1jxe.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1qz6fbk.36qj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-17iyicf.u5ir.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-7wtyiv.lniw9.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-aeh08b.bv4er.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-90w33y.yz2wg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16gkb4b.0l8k.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-z3c8wm.sp3a.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-vrjjq0.yfi28.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-5dsc8h.7elcw.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1x2hhkk.vnxd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-i0r6tz.yapn8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-fstgxu.urmz.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-u3hcrk.fyyrn.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1hw0h9x.fwcg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1uosmqe.5lio.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-16zkevm.4flgh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-v2a70r.j3eee.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-gt7l6b.pbeyn.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-1yd9g2h.vp7mk.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-1028-9wm2n0.txz5b.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-1028-hcs3o8.67pnt.jpg" "
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | panelweb.equi-hosting.fr | udp |
| US | 8.8.8.8:53 | panelweb.equi-hosting.fr | udp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | panelweb.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | panelweb.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | whoevenareyou.equi-hosting.fr | udp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
Files
\Users\Admin\AppData\Local\Temp\cb99d7f9-b6d3-47f7-af2b-4e5bcfd41bf1.tmp.node
| MD5 | e4c111d47eb54b62dab8cb12540b9e39 |
| SHA1 | 09be3e7d9eec1853dc628c8c3b90e7b670921029 |
| SHA256 | a05338fe1e0eb08230717ad2f3587a5c1cb4bd10a673c40a3059f70ae0e7e6b1 |
| SHA512 | f9ec1e62c08425382b48320d2fb1a7fa412dea84825cc49b0297d5c6cfdcb80f32c54de28ac59e7a4c7557ae9900a8d3860fc7d23e486bcc28e603787d9f0f79 |
\Users\Admin\AppData\Local\Temp\23a2f6b4-5e91-4e05-bc63-5f77b3c54b9c.tmp.node
| MD5 | f1e751eb4dbfa4a1b5f4903315fc535a |
| SHA1 | 85e1166819678f839954c473d7eb363a99e24a96 |
| SHA256 | b8c24de2fa870ceb677f30da0eabdf20745d0a9ebed98f49c52d881383c75096 |
| SHA512 | 2349745a84bc2b2f9c2b96999d48e37242a6c3627d7898cd9a36e682e36ec12553713db7167b3a9cd20ec308ce11d84f09f06beb3e971823d8b4a959f457b182 |
memory/2676-9-0x0000000000060000-0x0000000000061000-memory.dmp
memory/1028-39-0x0000000002A30000-0x0000000002A31000-memory.dmp
\Users\Admin\AppData\Local\Temp\9edd48d3-8da5-4554-90fc-ac8e5ccab80f.tmp.node
| MD5 | d4e6004197508892d18fc47645b25f62 |
| SHA1 | 1afceda2531e593c00de7ab994f928a150de5b4d |
| SHA256 | dc29d32decbd161ea4ff1e645d3fdf7a1ce3db0ee25e5485bc19fc775922b71c |
| SHA512 | 0be017eaba3764eb9f38e78248528a9e025958e713a8eb4a8f9b03d087267e107ceef8525a4ecfcbb684b077145fb0161e5dbe05f9fd95f8f94a140fe3ceb8a4 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt
| MD5 | dec2be4f1ec3592cea668aa279e7cc9b |
| SHA1 | 327cf8ab0c895e10674e00ea7f437784bb11d718 |
| SHA256 | 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc |
| SHA512 | 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
| MD5 | 810ae82f863a5ffae14d3b3944252a4e |
| SHA1 | 5393e27113753191436b14f0cafa8acabcfe6b2a |
| SHA256 | 453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c |
| SHA512 | 2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112 |
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
| MD5 | da0f40d84d72ae3e9324ad9a040a2e58 |
| SHA1 | 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f |
| SHA256 | 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b |
| SHA512 | 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9 |
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
| MD5 | 8951565428aa6644f1505edb592ab38f |
| SHA1 | 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2 |
| SHA256 | 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83 |
| SHA512 | 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5 |
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC37AF23513E3948838ED824B4512EF38.TMP
| MD5 | a6f2d21624678f54a2abed46e9f3ab17 |
| SHA1 | a2a6f07684c79719007d434cbd1cd2164565734a |
| SHA256 | ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344 |
| SHA512 | 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676 |
C:\Users\Admin\AppData\Local\Temp\RES3B1D.tmp
| MD5 | 069048e08ae8ce686ed3cae0a8a63721 |
| SHA1 | 8b1a1f5e269d5a3e3adb0bfcb009aa9da35874fb |
| SHA256 | 4f8ef2ee8f309b7ce379c0295a656a1c15ff4d36785688977a33e7c1a4143d47 |
| SHA512 | 6696224bda02d1e90c0192423a62adc2b372ecceb22e32fa567a52a45dddd0f404bff78a12739cb0e0ec03c07bd7a29a84e0f994bfb6073a45b691afdb85b060 |
C:\Users\Admin\AppData\Local\Temp\RES3BB9.tmp
| MD5 | b986903dff95b62b45879bb386d36dc4 |
| SHA1 | 0f2f5d08243481615f54c7f3b210f72705c7678a |
| SHA256 | 16beb0cf7525f48ed6d13ff29bae6f29ce5579c1ac522dd41bba465db7a9f8a9 |
| SHA512 | 6847c5798c2479acf87d313b5bbbf34bcaa5dff7e3f49b0d4579a8960f5161cfcd3eceff01d27d917bc12c8727fd89f243b11116f46e84d1279a94c9a7e2eef1 |
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
| MD5 | b9e72eb485c2ff9008ade48b20a87339 |
| SHA1 | 570f4df6a7b81df0f7a13fa0fffaf0d52aa0e0c5 |
| SHA256 | 21d9d5d4a71e06c22293904a7c65364dd511b89e058c999937a3ebce85f2837a |
| SHA512 | db16ec3a58a8563ae933fd26445d110edc24d9312cb7319fc46e80498f5c7d35866aac1888a1b9084e2f8ea61ae9412ab2a8970041237ba5e20a5b735324fd1c |
memory/1604-141-0x00000000008B0000-0x00000000008BA000-memory.dmp
memory/1604-153-0x000007FEF4AC0000-0x000007FEF54AC000-memory.dmp
memory/628-155-0x000007FEF4AC0000-0x000007FEF54AC000-memory.dmp
memory/3020-154-0x000007FEF4AC0000-0x000007FEF54AC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2024310-1028-khzcq2.pfos.jpg
| MD5 | ed253cf4142cdf42f90388b67b1fcb69 |
| SHA1 | 140d228b45f2804b31390d6be2e3414d2d0008c6 |
| SHA256 | c8299de971e72427a957c41c5ddd8693f769b768a0acb350c9a362ba152dfcbc |
| SHA512 | e7ff620d3f13cb360b1ab348dd759771433b1f9b791e9d4748d7721990bcb174014b81818943024d49bf084be4bf217a0d8ee9e58ddd46b4d3b9dae710e465df |
memory/628-161-0x000007FEF4AC0000-0x000007FEF54AC000-memory.dmp
memory/2232-173-0x000007FEF4AC0000-0x000007FEF54AC000-memory.dmp
memory/1360-179-0x0000000000FC0000-0x0000000000FCA000-memory.dmp
memory/1360-180-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1512-181-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1512-216-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1372-219-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1620-214-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1360-221-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2092-220-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2204-224-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/296-229-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1364-235-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2228-225-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/488-236-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1620-245-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/708-254-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/696-255-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2468-241-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/596-256-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2592-257-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1416-258-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1760-259-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2256-261-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/532-260-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2908-253-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2192-252-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1372-240-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2204-239-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/532-291-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/296-273-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2012-333-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1120-334-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2668-349-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3300-350-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3320-351-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3396-352-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3484-353-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3516-355-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3532-359-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3772-376-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2228-375-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1120-374-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3756-377-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3724-378-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2012-373-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2192-367-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/596-366-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/696-365-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1416-364-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/708-363-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1364-362-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/3500-356-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2744-325-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/488-316-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1316-292-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/1760-289-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/584-272-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
memory/2256-290-0x000007FEF40D0000-0x000007FEF4ABC000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20231129-en
Max time kernel
118s
Max time network
122s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 220
Network
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
142s
Max time network
161s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4624 wrote to memory of 216 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 4624 wrote to memory of 216 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 4624 wrote to memory of 216 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 216 -ip 216
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 628
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.80.50.20.in-addr.arpa | udp |
Files
Analysis: behavioral16
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240220-en
Max time kernel
120s
Max time network
125s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2364 wrote to memory of 1792 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
| PID 2364 wrote to memory of 1792 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
| PID 2364 wrote to memory of 1792 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2364 -s 88
Network
Files
Analysis: behavioral21
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
142s
Max time network
161s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C9E.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC3BC96A9EE8604E368C1DBE489C90435A.TMP"
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.80.50.20.in-addr.arpa | udp |
Files
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC3BC96A9EE8604E368C1DBE489C90435A.TMP
| MD5 | a6f2d21624678f54a2abed46e9f3ab17 |
| SHA1 | a2a6f07684c79719007d434cbd1cd2164565734a |
| SHA256 | ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344 |
| SHA512 | 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676 |
C:\Users\Admin\AppData\Local\Temp\RES9C9E.tmp
| MD5 | 60148e4f22e35fb9124a9a15623c5b6c |
| SHA1 | 1a610b342e9f5f017e168558f501f1356a57b656 |
| SHA256 | ab914167607994035eef0b2e95e62ca153368f67cd06ee2c79ea6477d7a0ec22 |
| SHA512 | d8dd8cd45a00babb04fa7a6a6025cea5c39b4d90d1899cd44ab7fee2f15ffd0bdb015ddb4e228f433fb879819e78c8f591d92ec7677a78010bfb8765eb92aa2a |
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
| MD5 | b554c628f7d387c97f8f577d606e14f3 |
| SHA1 | c1af1e70843b653ce9c8ce6d07a9461ab07584c9 |
| SHA256 | 114267199a85a2de2ef61c3b2df4aa1ff70ee0848972a2fa916d122cfa66ab2e |
| SHA512 | 5c3b15d6158b1566a354fee6ec5155d8a30822aaaa88c818f0ecb50b41fc113763022e9fa3965b19723e35e42d441a0202deea1abb7da713186734e7a0824d03 |
memory/1984-9-0x00000000003C0000-0x00000000003CA000-memory.dmp
memory/1984-11-0x00007FFC94EB0000-0x00007FFC95971000-memory.dmp
memory/1984-12-0x00007FFC94EB0000-0x00007FFC95971000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
27s
Max time network
153s
Command Line
Signatures
Enumerates VirtualBox registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Looks for VirtualBox Guest Additions in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Looks for VMWare Tools registry key
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\SOFTWARE\Wine | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Enumerates physical storage devices
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe"
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=gpu-process --field-trial-handle=1036,16798529948888971755,3425537687929227740,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
C:\Windows\System32\Wbem\WMIC.exe
wmic CsProduct Get UUID
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,16798529948888971755,3425537687929227740,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=1304 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --app-path="C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1036,16798529948888971755,3425537687929227740,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1492 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=gpu-process --field-trial-handle=1036,16798529948888971755,3425537687929227740,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1260 /prefetch:2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
C:\Windows\system32\taskkill.exe
taskkill /IM chrome.exe /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
C:\Windows\system32\cmd.exe
cmd /c chcp 65001
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1036,16798529948888971755,3425537687929227740,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=1648 /prefetch:8
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-uc0az8.o23h.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1o3dqp9.u40f.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ryjter.0yy.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-x42ahj.1wk2m.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-2ls0fq.vr627.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1sv4vu8.wb66.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1fwb0e0.damt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-docclk.1rfwq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-caefrh.2yy4c.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-131hyck.exqk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-13uvy3j.pah4.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-edworm.kz7k.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ux6xln.mb7wi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1w17tkg.pnch.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1km9ua9.3j63i.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1x13iis.x95l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-xe2mxm.5e2gh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-k3d11u.xjcz8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-19prmsq.zg5gl.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1o52t0p.tkhuf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-7kxk9b.mw86e.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-112bn9p.21hb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-hb3pz6.audjf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-gnj1u8.vtzoq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1thxqi.tz5tg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-4nrpsl.i2gd7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ihky3u.t1yai.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-nyp5vt.fojgf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1dykuv6.wjy7h.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-14jp529.wine.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1imlue1.r0glh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-wgq0nb.3uca8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1dkrr47.lo3v.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ib6qrt.4yaw.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1uarbk0.rsrw.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-2rquyy.edpqd.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1vzwi05.8q57.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-10osxyq.ooz4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-iqk0o6.a2d4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-13vnogh.2hge.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ltrbjt.pmwy.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-16c9ksv.ktls.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1s97q73.sjk1.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1295ejy.n7q7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ctm6is.hfra.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1f9wfge.t2xb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-116046e.kuu6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-s36t9t.17wje.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1py4ghs.3cxg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-9wdf04.ny08u.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1a2gcdy.syav.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1qxmqj3.wuebk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-bqsr8e.2tlq4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-19x76cb.10sv.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1eaeoae.umwf.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1de3vt.m445b.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1wbirv4.x2n7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-3ril1b.pevzq.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-mveces.jhjs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-7o1tah.q6swj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-oun4td.q0lt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ve2t7r.4r0a.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-16dm069.2qdle.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-chwsju.5kxl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1shb7b0.o6dh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-f7bs2w.affgs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-hjao5g.83pst.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ajd6jh.ihuwi.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-xa34kf.yo9o.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ma9nnp.ou6xh.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-isz7t.03c1oa.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-l7s474.1zt.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1w8zasx.v4v2.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1wuiqh0.d7sx.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-6e659y.nhbkf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ic2iqj.hjyld.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1wv4i1n.d4qj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1t9nezn.8s5f.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1iy2fmz.3dt9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-wcvid0.9vokq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-o7aea4.a1sh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-6a98q3.0trvj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-uzxpwd.a9uhf.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-imbofp.1flu.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-b0urrr.75kn.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-9wvk9.qunozp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ksy0gs.hj4x.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-bwzu0y.x9185.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-e52nja.zs9wq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1m1khar.ewmg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1wrybzd.79ds.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-7hebg9.6g3s3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1qinx95.x4hm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-11hp1x6.ex2s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1wmenje.utlf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1xsno5t.ojqn.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1gmw5er.tnm5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-abcerr.63af.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-iiichh.958e.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ng1nj8.cdc.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-19nr4v5.2lag.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-luffjt.3cbc.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1q25tgs.8x7l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-4ddsz.r0rt4n.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1laiuck.b1i7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ntnneg.mo4p.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1xkom9v.r9ni.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-qbnylg.iz3tq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1ogdddo.zcyz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1g8lnxz.xsdh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-19klz7o.714f.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1884yrz.8fxzh.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1hkfoxh.nqev.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-zf04lg.metp.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1suk4of.5e4l.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-15iptl4.hugg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ilfr7j.8pwvo.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1onirrt.hh50g.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1fqxrnr.84v8.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-h5txa4.im99c.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1a085l2.5p5j.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1mcnvdh.p0fa.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1sjg18f.76wig.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1j56n7d.ti7r.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-n3pk3f.stut.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-r5m31l.9qw7b.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-13zca4m.186f.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1jdemwd.oj38g.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-vanq6n.ix8te.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1t9lm7t.rmcp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-t0rwmf.tyky.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1eb07e6.vdxb.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-itzubh.f9uoj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-1qln6zz.dlkgf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-696-ac8snj.gf0eb.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 216.58.201.110:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.8.8:53 | panelweb.equi-hosting.fr | udp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | whoevenareyou.equi-hosting.fr | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| GB | 74.125.168.103:443 | udp | |
| GB | 74.125.168.103:443 | tcp | |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 172.67.176.119:443 | whoevenareyou.equi-hosting.fr | tcp |
Files
\Users\Admin\AppData\Local\Temp\nsi5957.tmp\System.dll
| MD5 | 0d7ad4f45dc6f5aa87f606d0331c6901 |
| SHA1 | 48df0911f0484cbe2a8cdd5362140b63c41ee457 |
| SHA256 | 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca |
| SHA512 | c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9 |
\Users\Admin\AppData\Local\Temp\nsi5957.tmp\nsis7z.dll
| MD5 | 80e44ce4895304c6a3a831310fbf8cd0 |
| SHA1 | 36bd49ae21c460be5753a904b4501f1abca53508 |
| SHA256 | b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592 |
| SHA512 | c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\chrome_100_percent.pak
| MD5 | 4f7cf265db503b21845d2df4dc903022 |
| SHA1 | 970b35882db6670c81bd745bdeed11f011c609da |
| SHA256 | c48e6d360aee16159d4be43f9144f77d3275a87b3f77eae548e357601c55fc16 |
| SHA512 | 5645d2c226697c7ac69ce73e9124630696516fc18286a5579823588f93a936da71084a3850f1f9a7b34c624f4c502957107f5957ffba5e6c1e4da6d8da7d3348 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\chrome_200_percent.pak
| MD5 | 6a7a9dee6b4d47317b4478dba3b2076c |
| SHA1 | e9167673a3d25ad37e2d83e04af92bfda48f0c86 |
| SHA256 | b820d19a7a8ce9d12a26837f967f983e45b07550b49e7b9a25e57b417c5f6fd9 |
| SHA512 | 67466e21a13ca449b014b511fb49bfc51df841eb5776f93b4bda2e0023da96d368ac5c65de051ed9de1899275b9f33839af2c387be903688cdb48bf08993791e |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\d3dcompiler_47.dll
| MD5 | 7641e39b7da4077084d2afe7c31032e0 |
| SHA1 | 2256644f69435ff2fee76deb04d918083960d1eb |
| SHA256 | 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47 |
| SHA512 | 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\ffmpeg.dll
| MD5 | 7977f3720aa86e0ec2ad2de44ad42004 |
| SHA1 | 04a4ef5ccd72aa5d050cc606a7597a3b388c6400 |
| SHA256 | 61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e |
| SHA512 | 8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\Ghostbane.exe
| MD5 | 21dcf914458e92f92928d52bd89470bf |
| SHA1 | cfe743e325859af219cc91b3e375b9afed58a6a9 |
| SHA256 | c68227296b243230fa9cb2fc7a1d3eed54de34db04bf0a8fb6b7c04c77bf44c5 |
| SHA512 | c8ccfd2cbc84b227c89e95988c51ddec76d99dd7cb06460c01c999bbe65018cd51422d9a03efa327d7e31723e0745658e47da54950959ef4e4d8d8cc9e22272c |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\icudtl.dat
| MD5 | 2e7d2f6c3eed51f5eca878a466a1ab4e |
| SHA1 | 759bd98d218d7e392819107fab2a8fd1cfc63ddf |
| SHA256 | b62b7240837172959299dc3be44fffa83dc374353154eca1612e1bde330aa8fa |
| SHA512 | 0f1465e8efe32b0eaba628a30bbb21254a05d80f4407a1434120a55fb928cf575b3879e1b7cf754cd19b23c262ae715fa84a8049073563cb38f1855be7db1124 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\libEGL.dll
| MD5 | 7b77074945dfe5cf0b1c5a3748058d57 |
| SHA1 | fdea507ac2be491b8ad24ddc1030ea9980c94c0d |
| SHA256 | 994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56 |
| SHA512 | d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\libGLESv2.dll
| MD5 | 8c93e19281992a00993fc0f09e272917 |
| SHA1 | 3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7 |
| SHA256 | 1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703 |
| SHA512 | c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\LICENSE.electron.txt
| MD5 | 4d42118d35941e0f664dddbd83f633c5 |
| SHA1 | 2b21ec5f20fe961d15f2b58efb1368e66d202e5c |
| SHA256 | 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d |
| SHA512 | 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\LICENSES.chromium.html
| MD5 | 4247afa6679602da138e41886bcf27da |
| SHA1 | 3bb8c83dc9d5592119675e67595b294211ddbf6e |
| SHA256 | bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4 |
| SHA512 | ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\resources.pak
| MD5 | 99c5bf0dcd43f961aa3e177f7dc42d42 |
| SHA1 | 5618abd2e7b45c50400bb4aa0c455bb0b28bc472 |
| SHA256 | 75ff04d991c2a203105525a1ccb200a461717ce7b86ada4be092fe903d95cdc8 |
| SHA512 | 2e508c46eb266301f42ee6a7d63494f3856b422df61d0b605096bf4fc4943239d3fba15161adf8cb1cdcfd3bea8608102a0abce636999cc2a9e01bda51cc77ae |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\snapshot_blob.bin
| MD5 | c497639990ef3d4435fd721e8e855c9a |
| SHA1 | 85e7df364daab70730c756b8e24e81965d5a2255 |
| SHA256 | 5e15a82831965e521bee172e6878806bba51d410d1fdf1b4eb01385d1954502b |
| SHA512 | 63f2514d585dd7d3b988f0aaeed8106a06b67629eb54f2152e8b4a24276d9f56fc4650c8770d0ab44b4c57ca458856a0cce5f26f6226a56a807b38ce5615ead3 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\v8_context_snapshot.bin
| MD5 | a718c9b6e5e6563e23e450a0d01b932a |
| SHA1 | 95ccb1228f024f037259e759dbac464f3c27b8cf |
| SHA256 | 315f5ed966a1f3a89c94d1b78b9bf70e59a2869601cf6551b2c1fd3e3b008447 |
| SHA512 | b04512e95ab3997bc7d5c65e2f526e124bf1895b139eb2b6c6c7b4a4aa381cd408eb2bba01f44b09b1936d24752baae288f24a32ed84687d3e7e0681b5387d01 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\vk_swiftshader.dll
| MD5 | 77f7b4f46cb3e06b53729fd1e562dfef |
| SHA1 | 223c09805220ff2b5c1dcbdd5c0396231ea34f11 |
| SHA256 | a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5 |
| SHA512 | 6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\vulkan-1.dll
| MD5 | 25afbdf6701013c57b19b92225920915 |
| SHA1 | 009300dd4ab3b81794388ce7d126ae90ff97535f |
| SHA256 | 22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c |
| SHA512 | 575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\vk_swiftshader_icd.json
| MD5 | 8642dd3a87e2de6e991fae08458e302b |
| SHA1 | 9c06735c31cec00600fd763a92f8112d085bd12a |
| SHA256 | 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9 |
| SHA512 | f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\bn.pak
| MD5 | ee25e9cf28fdd35846d8a9b3c4220eed |
| SHA1 | 702342cc207ced1bb585195abcf263cbc4ea0069 |
| SHA256 | 9994b9832bce803bee8c48a8176653099df7768074e3c54d09a18593376466b9 |
| SHA512 | 2b703cd07bacc9f70e36844f148c980cb112a806b4ca11f692b9bbe6995fd5636eb9bdc84c5cfaf79790dbbb1ecf7cf2b61a7d6ff89311eb4907c586e20b7dbd |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\bg.pak
| MD5 | 5ed6adc6158f554e71bdac7dc9731b16 |
| SHA1 | 394c8396c566d2b92cef881c332624be812115fa |
| SHA256 | 0a3e79a6d270d212037ccb5a8730b7abfc45c6e9175dd7e17d997daed0985726 |
| SHA512 | 796f107698e82dfad9ec8d2ac1fc3f79b1f3a339a06eccd783dcd262ddb7399f8e3c093799f16640cf7a4488f1d2eb04ba6b7cb14ac9e9fcf87488cb8305b35d |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ar.pak
| MD5 | 3a8a7a08fedb148ebee6d3300356e37a |
| SHA1 | 2e9ac1ea8b6396b909f823486538d5640ddcaa1a |
| SHA256 | 43636fc76a2da6ab562c4c3bcc1a5d548a169dc0e884484fb7e4341814c44c78 |
| SHA512 | 7951829cc7aa385bb5f8078a7af7d4f0b49fa8c05eecb2808eac3fb0e8700c63f92db888ad64f526d992a14d54948a6807bf06f9fb688aecea40311eaacea181 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\am.pak
| MD5 | ebe0e7e0c78fac281a3f0196da22cee9 |
| SHA1 | 689864d898905d43b8a70bdf37c5b339daaf48eb |
| SHA256 | 08d86a45ff0a4b21e74b06509c376ab0f907cae72a3e0cbf5c17fc275d10ac5d |
| SHA512 | 89b6603e5db8ad53ee5623c2c0f7e81194278dbdf5ed49c7480049006b20744fd4642743c2b4a264cafa87e7f787d6d6cbf26f12ff2b851333b3ba7541ebd933 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\cs.pak
| MD5 | f125738776a9fb8dbf25311fa3dadbcf |
| SHA1 | 3448b58d4810e69f5c1eca4e1484308c3ceff502 |
| SHA256 | 5d5089718677f9a4e677dec72058c376a5829921cd523ecb919d0da7766d3cd4 |
| SHA512 | ca5300e5fb73ed4ee8c108e875c66ce7f105693f3ba78cb00f33218febfdb3ea27fe26f118dff3fb2e4af66f722f8348760cb576aba48887be25fdfae4991776 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\de.pak
| MD5 | fceb00caf7e76e688007665feae99e83 |
| SHA1 | 06fece84cf7028b3871f144258b8d084faf8745b |
| SHA256 | 80e63ef1950b8438813271365a7b6a3f3aba0bacc179f5675654249f31c06a3c |
| SHA512 | 08c14eb299a035949e6b64a069cadee66c420b7d66bb00d65d6a1a08fbee08a57ab08f8e77c44387f0fe02b47aeb0bf2709a1979025613cb51af4ab82fc3b6d5 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\en-GB.pak
| MD5 | 074d3dd44706502de7c33e791794b23a |
| SHA1 | 564a73ffad9232052c692eb94f560d6b17227c47 |
| SHA256 | 9c3954a5ca2cf126370a1152e9281f41a7ca97c69293f556a2c79ea6729324ae |
| SHA512 | 6e1296d04b16534274fa438643ecee6e37d17ed935623f73d5a8f3510a194e0efda9ca60fac8d51d25763c4818050e23c306f9ee18284b8600610d14f7768d98 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\es-419.pak
| MD5 | cadd9ec43e823609c4bbdc418da6009a |
| SHA1 | 91bdd44d5972a4763227ee7c127fe122aefe195f |
| SHA256 | 6c8d074047d57a79cf5cadf9caa6e9a64bce0895743a3dd89ed1350cc91c1e4c |
| SHA512 | 2b9eae4072e46024e33f000b1df1a64246f70498a557f4a03234d3dd47aadb04883b98ebf48eec21f0d6ca4c8a62065f675fdb352be680a56644ea3ae1db93a5 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\fr.pak
| MD5 | e609419893f1d885a2f17f94805a441c |
| SHA1 | 31083ac114fa4077a7da7c796ab3744873fb893f |
| SHA256 | 8d71c36d04f2d6062458aa2614f7ce223b2ee9b4665556803f764f384b191091 |
| SHA512 | 77f965f436a009a5aacebed3cc15adde5a1054e1c699b8a50b947a7e78a97cf43317d50b0ab7a42532c77d320b7393007e47199f31c58f7acb6f462f98fdd4c4 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\hu.pak
| MD5 | ae13d7ddfeb82df9950c71a4ea0bd10f |
| SHA1 | 7b55315628060668f444b110031b1fc4715bda11 |
| SHA256 | 17758e2bc746f6d770fca8969ed0aa2d00658d68792d2e8bae94d7b58665d83f |
| SHA512 | f94247fecc4fda5bdbe9732f151cdffed337eee01f59aaab6e6452c570a549dfb87c0528484c1879a04af134ac883a21043c582d0a642e185e4e64e3aff830be |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ko.pak
| MD5 | f21c6033fa73bc7d3358c2467c9048d2 |
| SHA1 | 939f209f00e6664294872e0dc3b33a9015a2f1fb |
| SHA256 | d19cfa8ae07f23b81c0d40d7e751628844fc1aafb83d4bb4dcbe71caecf6ea2e |
| SHA512 | a4a4909ca56d3d924639cf1adab6d9ee512132c99c8e3dd37f2b949a1c816ab29ce81c01c658022e680344516201fdb0440abb97e577e6946e2731411674566d |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\nl.pak
| MD5 | a17bff141aec095625d0420c7a609b08 |
| SHA1 | edf3746b20ff9e3bdbf09b195e7781da1f799a91 |
| SHA256 | 7482c28c2a42a94615118b6b8cc7d002415923ca104ef86a95a4ad05c8db36b9 |
| SHA512 | 903c50c39160e40920bdcce0dc337e83b03bba00481f82ebc8ac1cf6927ebfaa75b1f9791038a71632c5e79bf7331bbf7468cc626e303929801c08f54d092c8b |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\sl.pak
| MD5 | cfb094955a5a8f655ce8a598d5a89706 |
| SHA1 | 181ace68b0c3be132ab73302ba7f7c8750f9adae |
| SHA256 | 15489195e92cf11354a9a02895aad2ba8f17aecb676dd77942054a4f3f0fd623 |
| SHA512 | a31e131663072c1192a4146321db5f0f457d27e14afc8ae40a92a4f255df4cd5302774534fed5247e145c73739a709dd5852af35750f35ecbab0fd4c1a612e2f |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\uk.pak
| MD5 | 33f02db055c3f91148feee375acabfb7 |
| SHA1 | ca1dc284f41bc55cf35f94a4039008df9970d411 |
| SHA256 | 1968e9ed7722089330e7a8ae2c08f241aa106ed2be8948461439e6a92c330688 |
| SHA512 | ad16973e4103ced979276c6de175eb600241491ec9c441168e6375f68f8867d3f0eba422dd0ef6404208564015119f1e5e2500d5cf4ff2d8da45d713ed8c251d |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\zh-TW.pak
| MD5 | 03ade5ba27cd3ae9bab6ab3a5cb721c2 |
| SHA1 | a747311a5f6c2e0e535efd52bc96f3c4d12d5c3f |
| SHA256 | 0c4abf7a66026068cd4f458d504cb04f3e04cf9fae45419ddc2d592f24899a2a |
| SHA512 | 33e122328773039595248a85dc0940841a1e273957ec9a4e175871b3ada48008b608ca6569b495275abb8e2a8844ee0c4d90b48af915a3f5a6aa44f3c37e51f3 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat
| MD5 | da0f40d84d72ae3e9324ad9a040a2e58 |
| SHA1 | 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f |
| SHA256 | 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b |
| SHA512 | 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\StdUtils.dll
| MD5 | c6a6e03f77c313b267498515488c5740 |
| SHA1 | 3d49fc2784b9450962ed6b82b46e9c3c957d7c15 |
| SHA256 | b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e |
| SHA512 | 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\swiftshader\libGLESv2.dll
| MD5 | 1e401ccda5b723ab8a595a54f7d2531c |
| SHA1 | 127716680dd16f776b19c2306d716935e54c5100 |
| SHA256 | c167a458174e2a280c39d7af31bd109e8e2921032a687097b584653adc33ab21 |
| SHA512 | 1f2f35021f338aa7c5a0ae83c196217fbca6b1d017ac1bb4f1eebb93bd6e18c5d74c1a14bd4899d7a91d054b0139b2c4fc3271c35148ad1d8b71139aff0132fc |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\swiftshader\libEGL.dll
| MD5 | be1b6fe26a1b5a3e1302c26ce5ce53f3 |
| SHA1 | c3cac08e89c4cc91eae1cc87e33a1dea723f1d78 |
| SHA256 | 162abe61314e720384d8cdd43190a89df8a96de52f3ede7b6c58998f615d8546 |
| SHA512 | 07dca111391dfb6b7e90d4be02071bc625128eeca0b9d9a3cebdc7916baec9f95cbbf906f2533befd6b62b9bbc69488ffa720f8d40c9710dd3b7d540d9dcaa55 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js
| MD5 | d226502c9bf2ae0a7f029bd7930be88e |
| SHA1 | 6be773fb30c7693b338f7c911b253e4f430c2f9b |
| SHA256 | 77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f |
| SHA512 | 93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest
| MD5 | 8951565428aa6644f1505edb592ab38f |
| SHA1 | 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2 |
| SHA256 | 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83 |
| SHA512 | 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\resources\elevate.exe
| MD5 | 792b92c8ad13c46f27c7ced0810694df |
| SHA1 | d8d449b92de20a57df722df46435ba4553ecc802 |
| SHA256 | 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37 |
| SHA512 | 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\resources\app.asar
| MD5 | 45521cfdc0f0979a1fde10a1bf163b64 |
| SHA1 | 4f736d4fc78020a8a8df6fba1de46c95ea0c50be |
| SHA256 | b2c42f78307d22cede05b010e4cffaaa70e9ee469c8279a3399a6f497d8cde24 |
| SHA512 | d8fe5278fadd3610cd379c352c2dfd6f16f01f3e3512c364dbebc8c9fddbc933203a5e424df65f6678243f8796bc0c5b509f1c648a11989c740a5dfbb52baf31 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\zh-CN.pak
| MD5 | 20b6d54de42cf9c56f0a85fdc27d82e8 |
| SHA1 | cecb82b4afe8544876f443fcf578453358ab59a8 |
| SHA256 | 4140caf95939f116993ecd8bc5f7681991f96735d2397c9c7b4c66e3013eed24 |
| SHA512 | 646af407dfb85863f4555961f37f706c18b5c1e68b3111eda9f9b531ba2bb60cf67211ad634037b872156f0ddd04d50d68c49173a27a78ce59f75cbc2bb6c3bf |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\vi.pak
| MD5 | 98cb45f0555aee1985710196db17d72e |
| SHA1 | 1362238c253bc2a0e50c8dde6c95deb027fd6348 |
| SHA256 | 39a130557fea33a9c899f347fa3ed455e58bd51acc0b3b4586f76694b0f34646 |
| SHA512 | 93125310ade0c7029f0406aab291c35d2b7d1941f85bfd3d6071f85ff347c46e793a5ef164c08ebfcba252269a4aa84bf7a3b8779a36ee2f3da303411becc27d |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\tr.pak
| MD5 | 4e7c047364c7c4809242741b98b28092 |
| SHA1 | 4ff1b303476cb75d8190568c346e8cc2e452da14 |
| SHA256 | 6a25be43b786ab853f8081c53012be623543830cce5ccd246ec040d98f22b852 |
| SHA512 | 4624cec04114c15a72a804fa4966fe61303effe97039337273ed0dc99e8a6a685ca5cf5fa901a84c8b219d443f1a89e6e7cbe09eb21e7ecff662301067a6cefb |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\th.pak
| MD5 | 96212a5191b7062d1620388acf1d09cd |
| SHA1 | d3616b6c4649dcfa347df0473e64219ccd63e63a |
| SHA256 | fa5f97bf433df481a6257fa39ef8dcc7961c5d5a83008b02c9773836d7bfc96c |
| SHA512 | 5192c36317c3a50696796c7286f77b1a02b7a0f83abb16ff7d47ec94281b85ee2fb29b9ddff7c4ad8b28a2a757772bd2bc726b10c19658ab672966679d391508 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\te.pak
| MD5 | 93edec428bdaa1f84f5c9478f440997a |
| SHA1 | e03f6bd50b0e0d888f9dfbdc87c98ff567e6a91a |
| SHA256 | a499f50e452ca02ea476fab8954e7ff58d2ee0c6263b8a4657b6ebddeecd2520 |
| SHA512 | ae34e29f1e8d23dacca66036e355b12ebb1117ec6e5e99413c792a0dc8b772eb63578b2406730b014fb4ffe32b05dfd9fab8adcf38ab3f5b9bfd0cf054ed09f7 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ta.pak
| MD5 | 8a1a245b43af1f174f262d8f53014d59 |
| SHA1 | 655045f5c71aa2589851a66d5387d4125bbce1ec |
| SHA256 | 85d8ef6fb5fdbd1d689aa6cdbbb768376b08b03ff39f7528a3804a3b4bd82af1 |
| SHA512 | d71b73fd2b5658acf5825f142130c49c278c801fd8beb5fb2039a3c209a1214a9cc00fb6896735fa4d020bc2279afca1577f35fb0a96a315631d46656d2055d3 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\sw.pak
| MD5 | 70510abd3079bf26caf327989e810216 |
| SHA1 | ea640cb8b3c63d71d9b3a0d377fef5540b04fe81 |
| SHA256 | a11017a3e0e7f48338d4515ec9e79c1764387232a0d9a05fecc4b594bff40091 |
| SHA512 | ecbc97397557e27e66536a97ddf78a744c104b258d40d6f31972e6e5c6615699dd24eb02144ae0d3d53764da0f83a06f561ba95bbf08da4bf4a548b0e7f8c052 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\sv.pak
| MD5 | 773fc8c89b093c40191fc233730188c1 |
| SHA1 | 28001794144bdb76f62044d57e2d52c8ae1635c6 |
| SHA256 | 6aab29795a36a0234c6d447fb1fdd9011da505c348b934346a27b6a2ddb92ff3 |
| SHA512 | f9bfd3e72955104b922c34352ec16d56939eea634b9abd549d4a3342dd72f8768c85bff59814e419aee6469f6521f4f71fcfe9b8a81c1824187ba818f6d6caac |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\sr.pak
| MD5 | f4041623ce5e06d2dea58d532edb120a |
| SHA1 | 2d7ee3ef60b39e3508427c7bc12e046d7bf5e928 |
| SHA256 | f2f80d7325d259811afea1e7648c42d3ef3eebfeddaec27ee2817f4e68ab541b |
| SHA512 | 18691f4cee3eeaa2305d1c978d803fdf757d9c4e87e88e36d7b1fff482cfddd820568b39a1108065f61dd2cf10d7219c27813aad4d64e71695ab91084ec3c694 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\sk.pak
| MD5 | befec33f564454253ad90d6cc06ecf62 |
| SHA1 | 1fa0e082c89f9aa397551421a35b7dfc941f5250 |
| SHA256 | 9db30eeac7f1814158283affa0af6451c6f7966896cd6d6df8eab14a37e58c9f |
| SHA512 | a581faf67311eb8d81b481d1e3348f579745331f87523650a4fc35ddbe6d5033e726feab0ca3911ef76a21aceabc3e2122d16333d1b7840a933b5231a9e2d157 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ru.pak
| MD5 | fd441a4b72397f5d76915ebcdef45aa1 |
| SHA1 | 94a0ab5704e7303c6ef1c2ee5be0b6f4a52d146e |
| SHA256 | df41fb92e4d682d47b5adf942600b4f23c1aa5274b31b844cd4c4b6f0ec86a86 |
| SHA512 | 5fab517ec0141bb67b4b5ac868100b770fc0b7773b94f977af9205294da9305a2079327a4ece1ff1d9a3b3c805c8d8676c2b0505bf190d1c57c4ed0c14a1cfdb |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ro.pak
| MD5 | 4d1ed9e347de9351454d11132c06e916 |
| SHA1 | e3734d17a579ac423ec5fdc5829a211c7b76e049 |
| SHA256 | 57dc80c76c535c645893c9d3b4d0c4779aaa877445383abec79e32cf02c41276 |
| SHA512 | bd3d0841678879a24eb6f2f15c27bcb64a5d7ad171debbb51e7601a3898b830b1985b365363a01d22967969d4d4ddf89a130a5a33ff6a94cef6410b0e89f1849 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\pt-PT.pak
| MD5 | e9f8bc9fd1e845551fe3bb63c9149726 |
| SHA1 | 0bfbe46e8ffd62493c019e890a30ebc666838796 |
| SHA256 | 50cadb4da4e61fc335d145374511c34e5a0e40f9c26363614cd907cc7942a777 |
| SHA512 | 1d3761caadc3ac750c0a89c64db472bcb0764fc1c4b1108a9443fa71633ec7fdd945120a6f05e76221d9c58103cc9865b4857877d57d60b623f92a0235ed15fb |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\pt-BR.pak
| MD5 | 3b70cbf1aa47436b78a5e8c7672ce775 |
| SHA1 | ff9f2820e5782f9eae0ea1d5ede61665fa62cc06 |
| SHA256 | 8b4a8a3b8741610c279283a6cb843cb274223f720edac1c73296340b02569fbe |
| SHA512 | 41e3b3264d8034edf9ee1ab696ca4612ee6ef4e8537b4598805362c4a250f81274425cfa2c9c62330fed73a683e6d3b2ff537b51d869d7da19c4422728da7c0a |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\pl.pak
| MD5 | 41fd7c76e30b333027e86e20a65283a8 |
| SHA1 | 81afebdfd62255d0b0ca508141dcd7b67982f4c1 |
| SHA256 | 5de95dc2236f896e66debfe2cc7553a5bfeaa7ffea2820fe1f2f67368af84f7e |
| SHA512 | c59132dc329ee72fa8e9e9c653da597b5fa40a6eb0a7988cf62b1bdaa646a9f09f504219bfbc5af394a12c9ab6050a39740460a3e5c3ed0946b556c33f608219 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\nb.pak
| MD5 | e5546ac3407546d6b786e24c7bc21ab1 |
| SHA1 | 7a9e44a525ae005d0b41020c403c4e1e49d237b7 |
| SHA256 | 751521cbf27777bc99f2039b987686f921cb27e02c959f6cbeb976799e45066e |
| SHA512 | becf51540db5a0893e6f44d588be98142bab5c2a0f37c0212348e3cf39da52def2fd104c039229b52767a9345890f5768ed897b4bde5c6feccd75036d8b4f363 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ms.pak
| MD5 | 0bb952597b170dd4dd76e9d9d546ac3d |
| SHA1 | 101aafdf6a4ac0cdba7bd88538e7ac395e715e3e |
| SHA256 | f6721ce0d4d601ffeff011d652a9bf2518386cd8c1d2317763e37512451534ff |
| SHA512 | 46c9b63273d6ea30ee63ff230d6b5600018ae54032e04a6707f5873ebd383d0d59645f8d0b44b8ce9a4d40d5acd3453b618b9c4fd3c1b958adb5aefba3465464 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\mr.pak
| MD5 | fd3452d812a6129b8b6db620423adca0 |
| SHA1 | 9bfe47a0e9f1843c90875f28d8873d592098024c |
| SHA256 | c9704a3e528092ef676be4a653cb14b906e7c32424d59c8e4f22981014bd9111 |
| SHA512 | 7ec30343e985f7bdc6a64fc13d50bfe58ae098b03e18afeaeb4c89073059698cdf40477f2323a52c5e8f07f37b28608c54734501d14ad6ae0c9a0f2f4ab0e689 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ml.pak
| MD5 | 21aee42070f9eace2a8e14759526f05f |
| SHA1 | fedd83251a3fdb1846bf0e7e49a3a78cd77fae02 |
| SHA256 | 393d2dcd5c7c33945626fcf10ea4457649fa7b4c100c039898385133c26395cc |
| SHA512 | 60cc85a5a638d370710680bd39a6946d04660a0856bde49190fbc0002acf91617cfc3f3087a37cf592c047550ed2c5b73c2a769fbdffcacf4ad3ffa129c929e3 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\lv.pak
| MD5 | 7313fab584b7561b1fa63de07b972118 |
| SHA1 | 3a44d445f57a78867d37638a80ab39add3fcaa4a |
| SHA256 | 7b92238240c31c197029d41fdffc244f68caeb8002854f65ee3125bd95643598 |
| SHA512 | 05b067847a63c0419298616278678ade6a4fec4008323121ace5a09e22f6dae409494474f5a88adc703833691a7d4810546d012d4311e176fe58812f166b8ae3 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\lt.pak
| MD5 | 02e9c88d9d5e58d135c9a92effcce38d |
| SHA1 | 92421a5fac68d506fa904075ea7cf39a3da8efc3 |
| SHA256 | 38ad40532287da53fcdb6076b9cdb841bbb4f30162681707295bcab448149e65 |
| SHA512 | f0897d62e81eb6e2c56cf1a5b5ad5124521c345f70cab841071c7b70b16130984700d694a32dfa010460244d8b520ba1b217ffd76f75c074b5b3a9ccda26b02b |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\kn.pak
| MD5 | 90107e2353e707a6d071c9aabb5adefa |
| SHA1 | e4dfe445ca7830b3a56af38af1d73e3cb94abc73 |
| SHA256 | 9155b06ccaefbea6461f5c51e25ce25d85ca7bd557e76dae00a4d6a09a4bc424 |
| SHA512 | dead3b94638afbf4ef27e1cb5283ad2d0af73ab8996e7d2e8202ad174796121799992f577c974fc0ec53fe2b8f6fb4d37c3bef70b72c29b5b721377a0cf3b093 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ja.pak
| MD5 | e720738027460b044429705f7ea1d25c |
| SHA1 | 851b59efad4ae074849fe41f40a56c5534caaf72 |
| SHA256 | c78fde77efbca1b3cc0cd12bda718d1a113bf6b6f3ed558b5c9a452dc974edfa |
| SHA512 | 08b0fd0ceff7ddfed26985bf84b54d75cead1f6fd4d5971da9e40996af6dc5fe9455c402f62e758020a6ccdb1ee0213cc2a5ddfa28a2bfb1e8064c6a4401c3a2 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\it.pak
| MD5 | a2b9cce245e754258ea187ceb3aa2670 |
| SHA1 | 50f84fbcabea10385714a3c3a2483247ac040c02 |
| SHA256 | b72f89e5d2cacbd2db7ce28ceae35faab8c4199ec993fea64e8c78df882032d0 |
| SHA512 | 5e9cca2605d4a86d4f2b39845c8396c37f88b6f1d08c8f0e2b6f0896d60754331a588d0c0fc59e9ad8fccf0d50100a2307fff2d9df784f91537b1d9e108727ad |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\id.pak
| MD5 | b5e4e0092bd1063e8bd68d0b539ab005 |
| SHA1 | 5e3d12a6fb497687df81ed64de17b0502ea84f2a |
| SHA256 | 8d7ef1377d39fb6045c9d4b1bb064c329bd789ee33b6de530c187f1e713dd7f0 |
| SHA512 | 52b535a143bc13a03804cfda2d3f2f81f036b8d24897d1ef4a657ed290ba14e43d7cfe92c868cdef6b093b09b90119f7e50e8496eaf347c8e4fdfc13c5e306a2 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\hr.pak
| MD5 | feea1754a955eb61cd41763be4e5ae2e |
| SHA1 | bb6252fec9ada8bf9ed7b81f59843d5abfcac80d |
| SHA256 | 787680ecb5d5ece246894481834b30145919c22b04d2dcad2f6ea2b2254abafb |
| SHA512 | 3d24c9ccb83f6ecf976df5cf00fdb0b46d53f09c1cb08ab68bb8d9944452785f40a761a152605708d7672f7dcb24e0b7cad1cfc14b267bf5fc1393cfd05ae4d0 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\hi.pak
| MD5 | 34bcb12c154075510d9d3066ad4a8d1f |
| SHA1 | 6a3c062221db4f391f8505892f584647b05a410a |
| SHA256 | 83c6c411d75ec5c5de6984b21fdecb07c9b926c66b67c5c99380605f6fdd8928 |
| SHA512 | aba38e4a8039bbdc46b510a8370c82d3b199b4a02da7751c162c941e6d893a9cdfc0ce92db4144ecc2b2644d58b0bc6cc7cceb0533c62c131cc55be0258c3a7f |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\he.pak
| MD5 | 6010987755f300c7984dd3f72f518ab2 |
| SHA1 | eb85f0849a86aa5fb585efaa070d2d7300b197a3 |
| SHA256 | 1c84a575e28e9a72335ed13409d6861995bd9859fd57a4d9509fe912db4a56a9 |
| SHA512 | 4b77f74d986c16524a3a6c7f60cdbe53ac5be59418737835a7fa186e4b6ee853cce8317cce352fe4064c75a7d27bf1303d76eabc53993ff1e4b7758a8ccc6228 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\gu.pak
| MD5 | 57cf11b4352e59f11b20b7ab754af031 |
| SHA1 | ca1716d419f175a2dd548929fd551dcbd1ef4bd7 |
| SHA256 | 55588f211c26e1deb47b04d39728ec051b99334c55d30252b94df57d0fba2f52 |
| SHA512 | c74360769323b3267aa218e994f49c7e135d4f320365a349a5362c1755c4b660050a070bec6c5446d4620be97a341270b6c01289db20ddf5199ece23117110a4 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\fil.pak
| MD5 | 693abd21a6855aeaa31f6c738c6b6fc9 |
| SHA1 | bb1fa375a9f0c682d9913b1c1610535eb2b4028d |
| SHA256 | f0bb231c710c025ad4643e2128867de6e111da867384082e7dc2d0769976b6ce |
| SHA512 | 03c68c45e3144a73251d950a8c7695e5b9c2c66711134016543ac07ee6eded723324d5312fad4624d35d0bfe9861ca4b7440d2445e6d3d6cff4a1a3cd5263c98 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\fi.pak
| MD5 | 4f323a2eb73ccd029e742cee4dfa9769 |
| SHA1 | b860372d21cc55eb7ddbbf9f5bac61fed39426de |
| SHA256 | e1888472c8e1330e70e514d0a1936749a7e5d39f67e7edc818661c2cbf3e301a |
| SHA512 | d07d0f74736cd32d73b3a33867e65a25b727b5c30cb743162908e23d958fb3ae97285f600a9ef8196e61be9d450da5903d1e468fceb3b05ced93aa600387fddb |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\fa.pak
| MD5 | e3f56d4b0fa2878ed6847631d3b05dea |
| SHA1 | 627f48d5423afcb3cade0789f058d60867419041 |
| SHA256 | 2ee67a38cce9ffae1a639be17c0ef7ed7c763d9c15c9621f300bf634e1f25a64 |
| SHA512 | e29c28717f31dc57c2294857680a439acec25478913ea425b0c7b6e50f3343b21fb7983c15352f9e3c001ffa0c8e500d92a1924acde32a4b5bf3f5b6c60c4142 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\et.pak
| MD5 | fcdea2954549e5d8f1e7a5de36ae4f74 |
| SHA1 | 41dcdcefbbab3e0e908d98ec9b6bac7eacecbb99 |
| SHA256 | d875bca2e8800657306727902f4f5fceec7415ea530bfa780ece0f016f792569 |
| SHA512 | 37ea008078083a36b07b1f5d0ca6e16f62b06a19266d8042efc796bf33c53200f37d3a37f5b48d024dbfab9e6689ec9c3f22d6e37e3898fa7deb61ace1fb2df3 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\es.pak
| MD5 | 39288ea031009bb9db582cbd93c7d534 |
| SHA1 | 467f76d33e39526a4d8cb6068eaf8e2791b3a9ee |
| SHA256 | 6cd39669df96b4b5b9047f7689338d3beb9ad7f8be2fddc595ef1ecbc47481c2 |
| SHA512 | 4a635e969cf2b09aab5f8723a3380c5e226bf0546019506d18de65c1e4a599d268b9ee2e03a65b245075f899a09697b7b535f1055c19344a411100c8f29d93b2 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\en-US.pak
| MD5 | 0dcd84e9e50a3e0819d5875ea889ced4 |
| SHA1 | 7c47f6e4e0cafec3a13c07d689d1dd6ff6516b1e |
| SHA256 | 699b6d7f05a484e76d3e1197a656247863e570f03cc02634c9dc42078a5c5007 |
| SHA512 | 153fc15f676d78d5d0f3a6862fc7eaa60c2a659c25ce87485f0253c321d9407a9b799b959104c27a8e7b5487f0de926ae8f375e2c3d313329112e48f2d001a17 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\el.pak
| MD5 | db449f218a705453eb10b5f418e28d7b |
| SHA1 | 7bc8fcc59c532bb086a7f081cd8d275a89dac835 |
| SHA256 | 73da35d01b91707846775bea7dc0331fc1caebd5c63d101aa8bb8bb58ca7f193 |
| SHA512 | 7dce45bc723d62498b335be0ab72dfc91c44c01f96f25c2314e9245a0eab28a92dcaa730b11f108b604545592445ed1612721416f60ae3bf55b1bd438bd04f78 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\da.pak
| MD5 | 22134b12d90fdc00f23a1e0a6fb04eec |
| SHA1 | 17c9fc2cacb6e5ccc393d1af9bdf3e8e63ecdaaa |
| SHA256 | 62020dd01b47b696e2e11d7f5598628c07782a96ea6bc013dc2ffe8c820b7c94 |
| SHA512 | 9cce6ffb2d84cedcc5ccf200080d6a2cab691468c042e8e48a5fdd809b5c0d067c322326e49d18f66da8e0b1d28adeda4cd03e12d7aa11350b72776737aa3427 |
C:\Users\Admin\AppData\Local\Temp\nsi5957.tmp\7z-out\locales\ca.pak
| MD5 | 53e3fb38f84f60b98d23b337e4f03f92 |
| SHA1 | 42e435837dd36872d2a413518a299cd293ff8536 |
| SHA256 | b00bd41c1222b3ea078df5b92cec1946e41430be241d0d57dc9baa4c70c91f3a |
| SHA512 | 98d0328e7370b1fec9e15ad0cff9e1353686fc581e3df9a8896e3c2e62ced044c4c51ea63f35ec8b7eb3e7df5c83ef5157468979b7f20e85480597042c1ac192 |
\Users\Admin\AppData\Local\Temp\6d720dfa-983a-4c92-8c3d-99803db7e2e1.tmp.node
| MD5 | e4c111d47eb54b62dab8cb12540b9e39 |
| SHA1 | 09be3e7d9eec1853dc628c8c3b90e7b670921029 |
| SHA256 | a05338fe1e0eb08230717ad2f3587a5c1cb4bd10a673c40a3059f70ae0e7e6b1 |
| SHA512 | f9ec1e62c08425382b48320d2fb1a7fa412dea84825cc49b0297d5c6cfdcb80f32c54de28ac59e7a4c7557ae9900a8d3860fc7d23e486bcc28e603787d9f0f79 |
\Users\Admin\AppData\Local\Temp\4a04df84-c801-46fc-93e4-0bc322066994.tmp.node
| MD5 | f1e751eb4dbfa4a1b5f4903315fc535a |
| SHA1 | 85e1166819678f839954c473d7eb363a99e24a96 |
| SHA256 | b8c24de2fa870ceb677f30da0eabdf20745d0a9ebed98f49c52d881383c75096 |
| SHA512 | 2349745a84bc2b2f9c2b96999d48e37242a6c3627d7898cd9a36e682e36ec12553713db7167b3a9cd20ec308ce11d84f09f06beb3e971823d8b4a959f457b182 |
\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | ab88a8cd4815a0a9547cbe0d89cc86a3 |
| SHA1 | d9072923290f575bcc4f8f03d735987135f48e70 |
| SHA256 | cac869180ecefea0b87e13885b53a882a7599ef52a1f1131ff86d73531a708d9 |
| SHA512 | 7398bebdb89af04ef3883b38c1c4aac1885aacc33d3b905e7e8fd6cd2f1f061d2ec2ab53fa716a94f0d59e872b8d436e67d1a9c3596c8a08d01c12474b0b9689 |
memory/696-575-0x0000000002670000-0x0000000002671000-memory.dmp
memory/2524-581-0x0000000000060000-0x0000000000061000-memory.dmp
\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | a67fd6b4d352d931596589c11e46ef1c |
| SHA1 | 6013a4f028fc5277898d5852158437514979e71f |
| SHA256 | 84f6088b17f584d61866eff1268d393fe2dab76461cc288b573de35fd943e032 |
| SHA512 | 762613e949fbe26c90380907f203cb4325ebc5fbe4a8ed08aad0651347dc7dc8dee1dd825e0ca3992322216277113cb9935a19fed0839637b076359ea1bbb7b4 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | 62f6617ffa37cb75180667940847e6b0 |
| SHA1 | 8ca0eb8491678b0381b968a7640b11996f6ad6ad |
| SHA256 | 712067d97e49b13fb1e30e04357ef411151fa6dd783671383310f800125d9084 |
| SHA512 | 44859d6f1aaebabd311e2591e33640c2e9220ec3d4b854137fba213ec8dbd7167bb280225d862a282a5d00821f944ee0714400c2b7fc0a30e49b2f33efcb83e3 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | fd640bbdc8969ef3e41e3892a78d33d0 |
| SHA1 | 2f9904563df72680ad535368e332dd0c69769f21 |
| SHA256 | 2c2b84d9a18b49cc400a7eaa3809c7b3d2e021e819bcc017eefbd1a682a920ee |
| SHA512 | c524e5bee59a2483d458b752208c65adaa0848b4a0380c550a91f91019aa6be6aba068c3d67239b4ef8a602cd3c5a57ec31d50b7ae4c6ce718e959b21063443f |
memory/2524-631-0x00000000775C0000-0x00000000775C1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | 60491f139aa954351d0a1856d892ad82 |
| SHA1 | e957c3bb6545740c49d7a078309f8337a3f2c0aa |
| SHA256 | 926592fa12471ad32ed630aa88000b96be673db14294112fea998a5760581b55 |
| SHA512 | 1efb4025ab16f04f04863317cb0f4c16974300f5585e95e8243b6afc3e40b5b7e6f72b2cae1d1f1392cf36a5bc7a0008f478059744d341127e0deead5484b335 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | 86feaf9ca9f7592dd4dfd45dd7992bb3 |
| SHA1 | cf656431ef148fbbbb43ed048310c1d5c36b2007 |
| SHA256 | 5046404b24531d9d675a5f3b1ef5b59733973f2b26e88bd73825da354c6630b5 |
| SHA512 | 8683cb3a3fd0da48edd72bf58f7537f39dec8ee58cec65bb633aaddaff5440c56dcbfa630b43d35108d2ee1b615a92fdec654ce0c0d081f5ad8a51447198f619 |
\Users\Admin\AppData\Local\Temp\f36ac44b-2d41-4bad-ad4e-6bfcb7feb2cc.tmp.node
| MD5 | d4e6004197508892d18fc47645b25f62 |
| SHA1 | 1afceda2531e593c00de7ab994f928a150de5b4d |
| SHA256 | dc29d32decbd161ea4ff1e645d3fdf7a1ce3db0ee25e5485bc19fc775922b71c |
| SHA512 | 0be017eaba3764eb9f38e78248528a9e025958e713a8eb4a8f9b03d087267e107ceef8525a4ecfcbb684b077145fb0161e5dbe05f9fd95f8f94a140fe3ceb8a4 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | 44e5e89ee18a67188e6bbdfcf6d471c7 |
| SHA1 | e6b747899d802d057c9730d1d1212d75f4d2a7db |
| SHA256 | 9f6edff7a5987706c7757a7e5f18bb586c62017a74875da22e1721fa9cadc07e |
| SHA512 | 27f279612e7b37e05221ebfe6064ab84df3458643889b58655838bab55692635aacff8cafbf6049cf79f5fce277e03ac986408d2e34d7ec0f70b0035cbe4f643 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt
| MD5 | dec2be4f1ec3592cea668aa279e7cc9b |
| SHA1 | 327cf8ab0c895e10674e00ea7f437784bb11d718 |
| SHA256 | 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc |
| SHA512 | 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
| MD5 | 810ae82f863a5ffae14d3b3944252a4e |
| SHA1 | 5393e27113753191436b14f0cafa8acabcfe6b2a |
| SHA256 | 453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c |
| SHA512 | 2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112 |
Analysis: behavioral10
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:41
Platform
win10v2004-20231215-en
Max time kernel
65s
Max time network
74s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3e1446f8,0x7ffb3e144708,0x7ffb3e144718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9367595825121550955,2809585402091375763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 178.223.142.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d6e17218d9a99976d1a14c6f6944c96 |
| SHA1 | 9e54a19d6c61d99ac8759c5f07b2f0d5faab447f |
| SHA256 | 32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93 |
| SHA512 | 3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47 |
\??\pipe\LOCAL\crashpad_5004_JBCKWTMVREGXCAFC
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7b998fe056393cafd83c71f38a583213 |
| SHA1 | e201530f9c31541ab5b8ce3091af202064067a07 |
| SHA256 | 02d4a6a6efcafb42db5a6d25539bae9d7bd907febbef7bfbeff1752eb1f14d92 |
| SHA512 | a9f5e505caf728bf52a476fcab4d2487e163992c07e6e04f84a2ec3401ff685c7c2314a299206e17b64911fb68deabe86d23ffb1ff277d1b2fd205a7fdcf7064 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 39768df7d23a9e6ff40aaa6e63da0345 |
| SHA1 | 5971f5c48fd299385e6b68962072e1d731e98258 |
| SHA256 | 903f9e6e48f349edd9fb9bd8038473f0241bacb2fa71ec42f73895a57f42ee8b |
| SHA512 | 9b7bc729247742a74826511ca3afb525887edd7fb20c4d95f189e9f6f61ff203af7a76cf490b3d5ad363528104f3697924032c67ae6a8f3b43a837c76b8ac410 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 610886c3a043c3ba358deede61472f8a |
| SHA1 | 0cddcc095a9de71f4b92e3a8f96e9620e4eee02e |
| SHA256 | 2acbc7caaeeb024434c49fb3abbc800bab534251aa622ccab38c320297b0de87 |
| SHA512 | 46641a258b8c854156b58f469e74d04479dc9070f66d811d0e1b8dfb24385dcd19e3cfaa856ea5e25d40827a2552faa5211025bbc777219eac2c661810d9ba1e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | c2ef1d773c3f6f230cedf469f7e34059 |
| SHA1 | e410764405adcfead3338c8d0b29371fd1a3f292 |
| SHA256 | 185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521 |
| SHA512 | 2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
Analysis: behavioral15
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
116s
Max time network
160s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 13.107.246.64:443 | tcp | |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
Files
Analysis: behavioral26
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240215-en
Max time kernel
122s
Max time network
127s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
Network
Files
Analysis: behavioral9
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
135s
Max time network
133s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f697a1eed895c63cda0f24f73fa50905f2503b3bf516ecf2766a24ea657a2105000000000e8000000002000020000000214cfd782dea65b1f628ee0ae89f065f8f87bf665327ef296e9cf9e7c01c869f20000000de1fef3bb840df176b071c8d0474884a735eb312f2cd4ec8ef477badd6b0dd85400000003ad366f304d9e7e1ad429e3bcbbfccb8024d819891ec5bda4132c9c89bba8650bdfd41a24bd9b19ff4a5d5a67a7796c44ee0c4fd39a9064fcbf14cd3670406da | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8019dfa3768bda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418936300" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF3B97C1-F769-11EE-A293-4AADDC6219DF} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000634fa3583c2dc98d91128572812d5138bad794b78f198dd1dd988596fdf713a1000000000e80000000020000200000007fa34437728f6228460a0c05c0cd9ef8002bf5d9b34df4f73af4e4b7528ec41590000000f3ba23e515eee19ed99d672328c98475e2b1e70ace72b175e6cd1decc41a1ef0565567024bcd89ab51fbae671fd8e24d11c615657d6066bd82191976f48f95ac50b26bde9a1d45f818e4d233e304fe3ce35ab49584f42b7bb8dcd239b89cc67321298ca8022bbc6cef6b3c005706fbdce28a339b147698ab62b08270dcc0aee925c2561d90c9cd54eff1bed94cfc0fcf40000000375123bee0ab98dff55f82ddd2bdc8b0082efbcfe8b15fc9c6ddd0ca09d1ddecef29b3352098e37374f957ce495edd34bbd22d5f7258ac02a3cc5fc9ba319d35 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2156 wrote to memory of 2072 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2072 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2072 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2072 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab3C47.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Tar3D58.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4343ad2f99eed517e8e0e9c2eaa6a33d |
| SHA1 | e8b3d8ae18be9dda4b5b030a4f14d4e0c5831513 |
| SHA256 | e9a6e535ad22cd1b591302c5a3056192b3df5eedc2642590cec4c0464320ba76 |
| SHA512 | b8c08c62b477933402aa3eae28337bb8531b98b4da52606fc0a246225b416335f9869c185c4a13cc272b878c3cb793bea0f32eb2400fb8f8767ceab9847041a0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 823290a6da04844f2c6868b7ff01e267 |
| SHA1 | 10451b8705060053932bb9128b13d1636d4b3010 |
| SHA256 | a367099d6152196c82ff713ac179283b7e6b7b61e0cf59b6e5e56e82bfb94693 |
| SHA512 | 79fa19ea4fe679872a2271a334da5d285c728e6335c2a0b73755956027a85ce14e5281d2fa7399ff89b5130a5b396134483a7eb98f4d0e39efa2001342e2c040 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 75d018c24ec235c0604d183f60f563ad |
| SHA1 | 0460ab5ac9eab8a7dfae3815756d79db9e70228b |
| SHA256 | efc3ab65417e13f9a0cb4d221fd7d1eacf813304bd1f3645de5b1a5e28ccea10 |
| SHA512 | 55bd48248015410fec0411f5e6a83bf0f2c4bb1c469cc3e95c2c51ec6ace6c6b35ec329b74df14e76cbd3578ef4fd619f8cf3b79673976334bae8b79389c29f3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ed508ed10d1f07de7be6ffe4b21a994f |
| SHA1 | cd7f7352a52cf3b5e4f4e0f8b464f925214b1ce2 |
| SHA256 | 0299c25aa5ee404a2ed1f79d8b447a428455e4e3eff1fda36d3f4860a5a82eff |
| SHA512 | aba1ee677dce454e8d3f2e92da2e45a88662b8737c903c17db4ba6d91f48b24ee4148ecc821fc4e19511eed2ba89758704f68d5f5f0e3caab9db7fd05902c6f5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 782c0361ab2bc4ba286e4f88d8766f9a |
| SHA1 | 0b3c740acc9f51db377e4099c4a94af76e62dd23 |
| SHA256 | 3cfbc6c3b6412e7e3985979b2b264c20b7633cb4dda2be3bd75257bc299139d1 |
| SHA512 | 58faf976dbe92b5ec31903672a1d09679d0657bc925f157c30793069e7c15bcc268397784ddd12fe674864f2f1119fc82d07a07015320b0d05dc58fb4624caad |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 876263cba5f21b8e833b8765116dfddd |
| SHA1 | 622345b4d6aa35ee3044bdc437e7c639eb0f1b7b |
| SHA256 | 71f855a59ae5a9f4ebfb4169fa92d4bc8c2aaf2508eb034975c58fa89416126d |
| SHA512 | db692545ba9f3eae7e3656e29f8975f74b14599af4941081a126e814cdb667f6904c09a5eea33f1815005c839544149904163f9411caa15def8c48d71ddb414f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0b8d599d2620b52c9104f0a11a488ba3 |
| SHA1 | 15c9e3e8577618b9c758a3cdb733b95370d70926 |
| SHA256 | 2ca71d44e5092f4cce11559803f1974e969ac357f7ea187a4abc49189c112c21 |
| SHA512 | 3a2c7b21a587a7b9ba9d4a9167393448e423a2ea71ba97dd3738a4aca8751605c5c982e96e13259b1717872b196fcf5c34ccadce4d5cf4a30e265e749f3f5b7b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 28477bd36ac445175bad0d0547433c59 |
| SHA1 | 82d27139df8c3d4c2f221f1efd09e63472e5510f |
| SHA256 | 58db0d23a823dd70f0c673551c9e06b199a32d59705058a9d5d63a1a753d7569 |
| SHA512 | 67c951ae62fb52265f01350dfde5c938e2bbab2426fc0e0744c691da6f4b3e17b79bf126ab1c68264fcfa4fb054e1f53cf35995ef2a880504dd4a66815961cbc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4506974bfae2b9863d1ebd41c133f612 |
| SHA1 | 7bc8f2f6ad9a5653367e7da5d319638932311037 |
| SHA256 | ac86e830cf683aab902d8fa5f4c6c575e11d984a663217bad6f0779b0aea63a9 |
| SHA512 | f1e96a20d2117e7b6ae62890b3438630849905aa8a66982bd593ba8bf5de222429063a274398a85c735e26215c0a762ce23818459c8dbfff6e2fa343d714948d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6eb52da9b553dfc3830bf619dcd70fcf |
| SHA1 | 7dfd560683f42506199e54fa70c5d5471fdd44ef |
| SHA256 | 2ad2c7b8bf242fc7d14d31c4b8499d79486f486fe5c60b8c9644883c1fb9b4cc |
| SHA512 | 93e1c6355ff0e3e295d892bc8c0ff44775f4d4e37988bf2e1de9c4905d92f865d5b716735e1cc2647e32329bed73a2a680281347bb03c8c91bb129533212ed34 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 48252007e569c3883e231a9a371a2977 |
| SHA1 | 197eb7b1719e0109a60664690a95397c4c845944 |
| SHA256 | 2991ba752c3525d59dbaf1af3eeb123a85234bc6ba46ba8c2882fcf710257494 |
| SHA512 | e42f1a0496df4e5f1a40822c30d8a80bcffcee3372a69b03729198ff6f3e996b18ab610bfa339174eec7f72cc055722523f40d961fd12caa4f17a50a7a7772a7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 40be58b191cf274be72f2773a744cde8 |
| SHA1 | da3af07a0b20702477e1f9883dcd8a91b804cbe8 |
| SHA256 | 5588727ec830c8c76cb40b41e92c151f3e61dbc9c4887604f9a6d9b7a8e71638 |
| SHA512 | 16d79d704beb78e24f34e4c208fba3050c7e007480c9035c5cf4ba8e9b9c08b7623065fa1f2ffa4815e06727dd2865d60cbd33356cf316da3a66e26b4af9b30a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b8ac80d242d16758360b7c5e6c4550f0 |
| SHA1 | 3eba7f5bd326315fb0c66a458864f6a5b03da584 |
| SHA256 | 5fa72d086d6835b0c082cbf03e55f32371408b46730e6279cde7d2ebc30861f6 |
| SHA512 | 81a51339a294cc8679611b33fdf82d0860743a8831916cf064751e2b7b26fe9bd86d9a9fb6f66089d3b7899e5c4199184b97de5db85f7ebc4b6350f707e8887a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e51b9b5c7c3badd529536573347b0717 |
| SHA1 | 50847b0c52ca8edfcf367e6fc87a049773594078 |
| SHA256 | d97708e7725c15d230f8b7e5ab574e074e5ca29387e9ccc19b78d7852c6110c3 |
| SHA512 | 29d4927cbdcb2414d68ab7f2f2040dc2a1dadcfdef82dc4cb2f540f1993d8012edc59a36fe2ab252b34eb4e309b2de62932178f0fe2da54a1603217a118a7278 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c4bbd53fd2591e68bb93c1604befea05 |
| SHA1 | 4477a74c2c17875fd271dc1bc51abcbaad23385e |
| SHA256 | 86186184afb529c5b2666055ed0f34a7d68a09f64cbcfcc42ecf82eb2b0ef427 |
| SHA512 | ef18f8df25fd12aba6347266b6fa920f0c5dff1a625f90c2a87dedf6b022956536ba597eb76f65ab59c66723778cedc7916b9052b0bc0f7996713d8581d1ec9c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e16438cdf55bc4918ad95056102afd16 |
| SHA1 | bedd5de36f1f6176c0f00c45e451b39c110d0cd1 |
| SHA256 | 3d87f6774fb55360c8cdddc0c0d5f7b234f09528caf0fff8f0968ee3b850c788 |
| SHA512 | e717240f57ac64e55734f3536614af2513457a0ac6177e45ead4bfd7d5bb7df3af7a874021a04cf7bb15715276d3948d5a85470529a48ad2190b0d6be6c03fb5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 09e59b95651cb2090783375f264bf964 |
| SHA1 | 3930baf0b735a5578ca4c716fc97a295fb48d07e |
| SHA256 | 474456f796d618e46e41eab8380b70374f05ca2f859af987a0df8f063bc55d35 |
| SHA512 | dd6198c5149190777b54f20e7a0549e48cea3eea402794afa326b406e170dbac40686c2010d1f85c60946a99639e25f81f1050f5f0ceb568682a89c99c2e3693 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1299a33a5402ea42d95736fbade3c951 |
| SHA1 | 2eec6bf547dd40ee8400d740fbbcb370ef02be38 |
| SHA256 | 850dd266075ae5fe23791f37dcbfd531cba6a812f2220e8ecb789101d1c08921 |
| SHA512 | 219c7d02917ffac9d7ca0e7649f859c765a4c2195bcf3f6b95e1180c0f697f62c5fae8c1f3180a527e41c2ef1ad3d0e69c746072dfeb965ff3ef506157c35664 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 60fbed56185d06624ef5b290d2a2ade0 |
| SHA1 | fbfb648a58ecdf9b7956be2387a1c271292e4ab9 |
| SHA256 | 83666f20e9ebc6b5458cefa95bccb627ad98d6014a32656b4169712e353567b7 |
| SHA512 | 05a0fa6c9f64aa3cac41893cbe97c3fa67d7550d4d9e5e8b274c3972514a6d8d89560f425f4e61f2a8f4830dacb20bef4f51a87e94a08801a26c2602ff9943f6 |
Analysis: behavioral17
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
148s
Max time network
155s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral23
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
122s
Max time network
154s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe
"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral24
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
118s
Max time network
124s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
Network
Files
Analysis: behavioral25
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240319-en
Max time kernel
150s
Max time network
162s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3460 --field-trial-handle=2536,i,8161505972217706694,705854963991409854,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.114.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| GB | 13.105.221.15:443 | tcp | |
| US | 8.8.8.8:53 | 154.173.246.72.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.125.209.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.118.77.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
Files
Analysis: behavioral27
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:44
Platform
win10v2004-20240226-en
Max time kernel
130s
Max time network
167s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=772 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 216.58.212.202:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 8.8.8.8:53 | 202.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.32.239.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.14.97.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 253.15.104.51.in-addr.arpa | udp |
Files
Analysis: behavioral31
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
148s
Max time network
154s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
110s
Max time network
145s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4948 wrote to memory of 4244 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 4948 wrote to memory of 4244 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 4948 wrote to memory of 4244 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4244 -ip 4244
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 612
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 13.107.246.64:443 | tcp | |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 172.217.169.74:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 74.169.217.172.in-addr.arpa | udp |
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
119s
Max time network
126s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral18
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:44
Platform
win7-20240221-en
Max time kernel
118s
Max time network
136s
Command Line
Signatures
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js
Network
Files
Analysis: behavioral29
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
145s
Max time network
154s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
Files
Analysis: behavioral30
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
118s
Max time network
123s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2180 wrote to memory of 500 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
| PID 2180 wrote to memory of 500 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
| PID 2180 wrote to memory of 500 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2180 -s 88
Network
Files
Analysis: behavioral32
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
117s
Max time network
121s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 220
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Enumerates physical storage devices
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe"
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
C:\Windows\System32\Wbem\WMIC.exe
wmic CsProduct Get UUID
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=gpu-process --field-trial-handle=1580,108699910234291306,7382525001920131351,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 /prefetch:2
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,108699910234291306,7382525001920131351,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=1964 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --app-path="C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1580,108699910234291306,7382525001920131351,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2460 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
C:\Windows\system32\taskkill.exe
taskkill /IM msedge.exe /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
C:\Windows\system32\taskkill.exe
taskkill /IM msedge.exe /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
C:\Windows\system32\cmd.exe
cmd /c chcp 65001
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1580,108699910234291306,7382525001920131351,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=3048 /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x41c
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ftjo8u.uqbl5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1ry6gb3.wxq8f.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-5djwd5.8jvnn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1spaxq1.c4ud.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-wvfnrt.c6lrj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-10e7pj3.w5e7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jebhp8.hcuo.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-8rzuqr.eqwg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1992mfr.y3vd.jpg" "
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ipl83v.mi5nf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-12vz6ng.twq9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1shne4v.ajrh.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1j1msqv.b4wk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-4kp1vk.bp75a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-8mlhji.n8x05.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1sxstws.yd2l.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-8yks1o.8pzi6.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-wwt4qe.4l69g.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-114ec9z.7yy.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-v9pf2y.64o2k.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ycvbnx.cmx5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-dsk9tp.epek9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-vhwsc8.rcmig.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15u53n2.yes9.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jvfgz1.6018.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1erpzex.1q26.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-y5nxqt.q6xcp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-14tnf3x.8bvs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-clpd3l.umx06.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1uux4s0.llfnm.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jebhp8.hcuo.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1kkxzoq.6gwkg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-y0zd4f.z1n.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ij0gw0.waa3.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-4kp1vk.bp75a.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1sxstws.yd2l.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-2tz6iy.f1199.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-c6cqgz.05rh8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1lwgbap.q74k.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1kofssi.7uh7.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1cwpmmu.qm64.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-8yks1o.8pzi6.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-i0dbq8.3uxc.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-114ec9z.7yy.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-5fuwvb.vq1j.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-18brlh5.8rlm.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-wwt4qe.4l69g.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-gfvipb.7ntqe.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1hf6dvt.2cxr.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-inmxrm.wvbii.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1gm3919.bypj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-oflbny.ck43a.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-18gybv0.ojrz.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-eafgxu.ohdfj.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qm2oo4.j6rp.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-rq4wj0.b22ao.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-5sh0vw.41cm2.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-v9pf2y.64o2k.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-smc8cf.v0pp.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1avut7a.hf97.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-d3n2kx.ohc9w.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-2optcs.ipdtx.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-fg0e0w.frk0t.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1l0uv8r.7cjn.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-tdk3e0.lxn69.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-w8uz6p.njj7o.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-5myd3v.lwiy8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-t8cezu.3wqtq.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ycvbnx.cmx5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1bu74o3.27wuf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-zrqkcs.pog4.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15u53n2.yes9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-q4x04m.elag.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-mix7vj.t8an.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-vhwsc8.rcmig.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-flzfqq.27qz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1rbmdjv.nnk5.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-dsk9tp.epek9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-428mue.oxmw4.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1stkppa.n8wk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1j63jo9.m09n.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-7liwnd.eo1e9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-wi23cr.nzyv.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-dvxuro.yftt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-zqthg0.yy4k.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1lbw4qh.i29h.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1erpzex.1q26.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-tlocwa.z0ypl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1yz1t4o.s5g8.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-y5nxqt.q6xcp.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-25apn9.aoqwt.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-yn0xck.ck7k7.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-14tnf3x.8bvs.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ws6q6u.0bhr.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-clpd3l.umx06.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1szkmoj.a6ej.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-v0f3v.mrg90k.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1ox0g4b.s0ks.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1glz2mx.bce2.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-jm5z2q.iyop.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qz8aoa.txnz.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1xb29h5.rard.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qw8m0s.l3q5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-beg5lf.i009m.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1gvpckr.d8zgf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ickxbg.9we2k.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qb43ll.acup.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1kkxzoq.6gwkg.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1asv0ut.7w0c.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-7v3ve1.tvneq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1rks5gk.ot5f.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1uqk7mp.8wq6f.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1p6ov7g.gwq2.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1mtpv4b.alf8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1byzj2d.pi8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-393gtj.qs22s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1xi87gq.1vlq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-63tucz.hh1xx.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-5fuwvb.vq1j.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-18brlh5.8rlm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15z6s9j.5fsm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1o04azv.hibt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-o7a3ox.e4yud.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-oflbny.ck43a.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-8rm506.v69kg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-pnfid4.o7akt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-18gybv0.ojrz.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-xtdynz.xwar.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1lkvbrh.9ab8.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jk5yfa.08cs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-h838d8.aj1iv.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-zrqkcs.pog4.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-flzfqq.27qz.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-dvxuro.yftt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-428mue.oxmw4.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1j63jo9.m09n.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-19drmus.sarjk.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-13f5pif.kycv.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-wi23cr.nzyv.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-quhfn8.2nsyg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1e8s8p2.4b3a.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qz8aoa.txnz.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1glz2mx.bce2.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-14e2ook.ki7m.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1288zqg.qrxy.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qw8m0s.l3q5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1beqoog.lfda.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1mz552o.6qa0k.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1l0uv8r.7cjn.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-z7axaa.4e6qf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ickxbg.9we2k.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-beg5lf.i009m.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1gvpckr.d8zgf.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-org8vb.una.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1ufq5xu.4k49i.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-mix7vj.t8an.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-o8otz7.51q.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-y6kdjb.86bv.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-q4x04m.elag.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jac79z.d016j.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qb43ll.acup.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-tuv1uu.v50i.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1kj5o8g.m51z.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-nsnmb7.hxrwr.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1rks5gk.ot5f.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1pw9j0j.v0lf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-2ldngo.2pml4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-hs0sa5.p7zl.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1oowj3d.1jpc.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1metans.m5yo.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1rbmdjv.nnk5.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1auylbp.x0gp.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-tlocwa.z0ypl.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1byzj2d.pi8.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-393gtj.qs22s.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-a5ouda.ycscn.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1mtpv4b.alf8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-cbsksh.5hfcl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-14j3uba.rphz.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1fsadca.q8iz.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-617p0m.rydvv.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15sqb99.5qp7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1uhfuyw.7f8jf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1ox0g4b.s0ks.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1asv0ut.7w0c.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-7v3ve1.tvneq.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-188kj4d.o8pkh.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1yz1t4o.s5g8.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-akzijy.og176.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1xi87gq.1vlq.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-63tucz.hh1xx.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-jjgok6.ufaam.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-cg9dm4.c9qk4.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-xxafaa.04wll.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1o04azv.hibt.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-79sqz9.oy1j3.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15z6s9j.5fsm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1eiy3sy.hcvf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-10jap40.vk7c.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-7w7978.k7ni.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1hqrlbx.vgk6.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-bpjosr.ld4fg.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-7xasub.luw3.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-4ej7ae.revcy.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-3bkf1u.bels7.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-8rm506.v69kg.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-18wdw0c.x04x.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1eqjuku.saza.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1y900q7.1jsw.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-o7a3ox.e4yud.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-p955w0.y8v3.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1py7e4l.mf3m.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15o8mni.uiqe.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-4ih1mq.4ubm.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1rts3c0.9544.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-bhp7hb.ibhxm.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-16648uk.61okl.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-xtdynz.xwar.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1tsqdgo.ezcvl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-t62alk.i4laq.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-tvdq00.5gs19.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1lkvbrh.9ab8.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1iq3xlz.qo0o.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jk5yfa.08cs.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ya6xv2.30hve.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1fwhit0.fvf6.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-zx4dqi.v10s.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-kas9nx.k9trm.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-12nfkxk.u4hwg.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-h838d8.aj1iv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-vn8uwl.mzda.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-16fre4o.oa07.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1799e8o.aid5.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-173xq1k.wrcf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-10twji8.e3yd.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1idp45v.0qs9.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-i242o4.cp2s.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1f3hpz9.rzga.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-19drmus.sarjk.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1kpmo2z.p4sc.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-182kuk4.6e6gh.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1vstjb5.6id7.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-13f5pif.kycv.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1y62xsa.prhu.jpg" "
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
"C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe" --type=gpu-process --field-trial-handle=1580,108699910234291306,7382525001920131351,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4496 /prefetch:2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1gpx7ji.hll0j.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1lzdw6d.7yrll.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1uqle7x.zrmgk.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-o8la7q.k1ylq.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1o6dyia.80pt.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1ocff1f.724bg.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-3vhxcp.tt7hj.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-quhfn8.2nsyg.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1e8s8p2.4b3a.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-13rq6yg.qhj4.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-17nbxci.7n76.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1r7tolf.wnew.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-14e2ook.ki7m.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1br8jgi.89n2.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-u58ll3.utic7.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-lk4x7f.2gjdf.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1qdempw.qccx.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1mz552o.6qa0k.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-z7axaa.4e6qf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1288zqg.qrxy.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-13urhae.pv9y.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1m8u9ha.112cl.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ki3f0q.0h1w.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-o8otz7.51q.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-mfz3ux.wx6cf.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1beqoog.lfda.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-org8vb.una.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1ufq5xu.4k49i.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-qt6juc.b4vqs.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-o61uxb.p5d9.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-akzijy.og176.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1gbr9cn.cgmb.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1apylid.8wtv.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-y6kdjb.86bv.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1jac79z.d016j.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-nsnmb7.hxrwr.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1nw1qyb.mjqu.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1pw9j0j.v0lf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1kj5o8g.m51z.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-hs0sa5.p7zl.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-rt9ooo.1vfo.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-2ldngo.2pml4.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1altusp.854ch.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1auylbp.x0gp.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1metans.m5yo.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-tuzas1.ppwj.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-17eq00x.5ueo.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-a5ouda.ycscn.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-19rz4x3.6pzp.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1t2a2zq.xgy1.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-xxafaa.04wll.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-10jap40.vk7c.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-ujlhba.4iav.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1l9fyr0.yvfy.jpg" "
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1eiy3sy.hcvf.jpg"
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024310-3732-15sqb99.5qp7.jpg"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-1hb7oht.ogm9.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-11p4ik.1o90vc.jpg" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024310-3732-183wp8b.88dk.jpg" "
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | 192.186.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | panelweb.equi-hosting.fr | udp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | whoevenareyou.equi-hosting.fr | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | 54.40.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 233.134.159.162.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | whoevenareyou.equi-hosting.fr | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 208.14.97.104.in-addr.arpa | udp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | whoevenareyou.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | panelweb.equi-hosting.fr | udp |
| US | 172.67.176.119:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 8.8.8.8:53 | 119.176.67.172.in-addr.arpa | udp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
| US | 104.21.40.54:443 | panelweb.equi-hosting.fr | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\System.dll
| MD5 | 0d7ad4f45dc6f5aa87f606d0331c6901 |
| SHA1 | 48df0911f0484cbe2a8cdd5362140b63c41ee457 |
| SHA256 | 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca |
| SHA512 | c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\nsis7z.dll
| MD5 | 80e44ce4895304c6a3a831310fbf8cd0 |
| SHA1 | 36bd49ae21c460be5753a904b4501f1abca53508 |
| SHA256 | b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592 |
| SHA512 | c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\chrome_100_percent.pak
| MD5 | 4f7cf265db503b21845d2df4dc903022 |
| SHA1 | 970b35882db6670c81bd745bdeed11f011c609da |
| SHA256 | c48e6d360aee16159d4be43f9144f77d3275a87b3f77eae548e357601c55fc16 |
| SHA512 | 5645d2c226697c7ac69ce73e9124630696516fc18286a5579823588f93a936da71084a3850f1f9a7b34c624f4c502957107f5957ffba5e6c1e4da6d8da7d3348 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\chrome_200_percent.pak
| MD5 | 6a7a9dee6b4d47317b4478dba3b2076c |
| SHA1 | e9167673a3d25ad37e2d83e04af92bfda48f0c86 |
| SHA256 | b820d19a7a8ce9d12a26837f967f983e45b07550b49e7b9a25e57b417c5f6fd9 |
| SHA512 | 67466e21a13ca449b014b511fb49bfc51df841eb5776f93b4bda2e0023da96d368ac5c65de051ed9de1899275b9f33839af2c387be903688cdb48bf08993791e |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\ffmpeg.dll
| MD5 | 7977f3720aa86e0ec2ad2de44ad42004 |
| SHA1 | 04a4ef5ccd72aa5d050cc606a7597a3b388c6400 |
| SHA256 | 61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e |
| SHA512 | 8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\d3dcompiler_47.dll
| MD5 | 7641e39b7da4077084d2afe7c31032e0 |
| SHA1 | 2256644f69435ff2fee76deb04d918083960d1eb |
| SHA256 | 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47 |
| SHA512 | 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\Ghostbane.exe
| MD5 | 1cdd3986ca1dafd3a68fa64126a6bb23 |
| SHA1 | 2e24d3824ad6bc764fe025945b4563d7f7d8f214 |
| SHA256 | 417aa8b729c3b3fc8c92654a799080c175fb8c11e387fd2dd3804b1669998547 |
| SHA512 | 3f29875c7996de30ee96955b3ec1015aa062f5e61432c03a87cee18ada6693a9844d54e276b8367b554f5eef3e25c811f11380477b04e0125c7ef28a0c3eb8b7 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\libEGL.dll
| MD5 | 7b77074945dfe5cf0b1c5a3748058d57 |
| SHA1 | fdea507ac2be491b8ad24ddc1030ea9980c94c0d |
| SHA256 | 994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56 |
| SHA512 | d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\icudtl.dat
| MD5 | 2e7d2f6c3eed51f5eca878a466a1ab4e |
| SHA1 | 759bd98d218d7e392819107fab2a8fd1cfc63ddf |
| SHA256 | b62b7240837172959299dc3be44fffa83dc374353154eca1612e1bde330aa8fa |
| SHA512 | 0f1465e8efe32b0eaba628a30bbb21254a05d80f4407a1434120a55fb928cf575b3879e1b7cf754cd19b23c262ae715fa84a8049073563cb38f1855be7db1124 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\libGLESv2.dll
| MD5 | 8c93e19281992a00993fc0f09e272917 |
| SHA1 | 3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7 |
| SHA256 | 1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703 |
| SHA512 | c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\LICENSE.electron.txt
| MD5 | 4d42118d35941e0f664dddbd83f633c5 |
| SHA1 | 2b21ec5f20fe961d15f2b58efb1368e66d202e5c |
| SHA256 | 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d |
| SHA512 | 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\LICENSES.chromium.html
| MD5 | 4247afa6679602da138e41886bcf27da |
| SHA1 | 3bb8c83dc9d5592119675e67595b294211ddbf6e |
| SHA256 | bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4 |
| SHA512 | ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\resources.pak
| MD5 | 99c5bf0dcd43f961aa3e177f7dc42d42 |
| SHA1 | 5618abd2e7b45c50400bb4aa0c455bb0b28bc472 |
| SHA256 | 75ff04d991c2a203105525a1ccb200a461717ce7b86ada4be092fe903d95cdc8 |
| SHA512 | 2e508c46eb266301f42ee6a7d63494f3856b422df61d0b605096bf4fc4943239d3fba15161adf8cb1cdcfd3bea8608102a0abce636999cc2a9e01bda51cc77ae |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\snapshot_blob.bin
| MD5 | c497639990ef3d4435fd721e8e855c9a |
| SHA1 | 85e7df364daab70730c756b8e24e81965d5a2255 |
| SHA256 | 5e15a82831965e521bee172e6878806bba51d410d1fdf1b4eb01385d1954502b |
| SHA512 | 63f2514d585dd7d3b988f0aaeed8106a06b67629eb54f2152e8b4a24276d9f56fc4650c8770d0ab44b4c57ca458856a0cce5f26f6226a56a807b38ce5615ead3 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\vk_swiftshader_icd.json
| MD5 | 8642dd3a87e2de6e991fae08458e302b |
| SHA1 | 9c06735c31cec00600fd763a92f8112d085bd12a |
| SHA256 | 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9 |
| SHA512 | f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\vk_swiftshader.dll
| MD5 | 77f7b4f46cb3e06b53729fd1e562dfef |
| SHA1 | 223c09805220ff2b5c1dcbdd5c0396231ea34f11 |
| SHA256 | a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5 |
| SHA512 | 6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\v8_context_snapshot.bin
| MD5 | a718c9b6e5e6563e23e450a0d01b932a |
| SHA1 | 95ccb1228f024f037259e759dbac464f3c27b8cf |
| SHA256 | 315f5ed966a1f3a89c94d1b78b9bf70e59a2869601cf6551b2c1fd3e3b008447 |
| SHA512 | b04512e95ab3997bc7d5c65e2f526e124bf1895b139eb2b6c6c7b4a4aa381cd408eb2bba01f44b09b1936d24752baae288f24a32ed84687d3e7e0681b5387d01 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\vulkan-1.dll
| MD5 | 25afbdf6701013c57b19b92225920915 |
| SHA1 | 009300dd4ab3b81794388ce7d126ae90ff97535f |
| SHA256 | 22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c |
| SHA512 | 575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\am.pak
| MD5 | ebe0e7e0c78fac281a3f0196da22cee9 |
| SHA1 | 689864d898905d43b8a70bdf37c5b339daaf48eb |
| SHA256 | 08d86a45ff0a4b21e74b06509c376ab0f907cae72a3e0cbf5c17fc275d10ac5d |
| SHA512 | 89b6603e5db8ad53ee5623c2c0f7e81194278dbdf5ed49c7480049006b20744fd4642743c2b4a264cafa87e7f787d6d6cbf26f12ff2b851333b3ba7541ebd933 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\bg.pak
| MD5 | 5ed6adc6158f554e71bdac7dc9731b16 |
| SHA1 | 394c8396c566d2b92cef881c332624be812115fa |
| SHA256 | 0a3e79a6d270d212037ccb5a8730b7abfc45c6e9175dd7e17d997daed0985726 |
| SHA512 | 796f107698e82dfad9ec8d2ac1fc3f79b1f3a339a06eccd783dcd262ddb7399f8e3c093799f16640cf7a4488f1d2eb04ba6b7cb14ac9e9fcf87488cb8305b35d |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ar.pak
| MD5 | 3a8a7a08fedb148ebee6d3300356e37a |
| SHA1 | 2e9ac1ea8b6396b909f823486538d5640ddcaa1a |
| SHA256 | 43636fc76a2da6ab562c4c3bcc1a5d548a169dc0e884484fb7e4341814c44c78 |
| SHA512 | 7951829cc7aa385bb5f8078a7af7d4f0b49fa8c05eecb2808eac3fb0e8700c63f92db888ad64f526d992a14d54948a6807bf06f9fb688aecea40311eaacea181 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\cs.pak
| MD5 | f125738776a9fb8dbf25311fa3dadbcf |
| SHA1 | 3448b58d4810e69f5c1eca4e1484308c3ceff502 |
| SHA256 | 5d5089718677f9a4e677dec72058c376a5829921cd523ecb919d0da7766d3cd4 |
| SHA512 | ca5300e5fb73ed4ee8c108e875c66ce7f105693f3ba78cb00f33218febfdb3ea27fe26f118dff3fb2e4af66f722f8348760cb576aba48887be25fdfae4991776 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ca.pak
| MD5 | 53e3fb38f84f60b98d23b337e4f03f92 |
| SHA1 | 42e435837dd36872d2a413518a299cd293ff8536 |
| SHA256 | b00bd41c1222b3ea078df5b92cec1946e41430be241d0d57dc9baa4c70c91f3a |
| SHA512 | 98d0328e7370b1fec9e15ad0cff9e1353686fc581e3df9a8896e3c2e62ced044c4c51ea63f35ec8b7eb3e7df5c83ef5157468979b7f20e85480597042c1ac192 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\bn.pak
| MD5 | ee25e9cf28fdd35846d8a9b3c4220eed |
| SHA1 | 702342cc207ced1bb585195abcf263cbc4ea0069 |
| SHA256 | 9994b9832bce803bee8c48a8176653099df7768074e3c54d09a18593376466b9 |
| SHA512 | 2b703cd07bacc9f70e36844f148c980cb112a806b4ca11f692b9bbe6995fd5636eb9bdc84c5cfaf79790dbbb1ecf7cf2b61a7d6ff89311eb4907c586e20b7dbd |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\da.pak
| MD5 | 22134b12d90fdc00f23a1e0a6fb04eec |
| SHA1 | 17c9fc2cacb6e5ccc393d1af9bdf3e8e63ecdaaa |
| SHA256 | 62020dd01b47b696e2e11d7f5598628c07782a96ea6bc013dc2ffe8c820b7c94 |
| SHA512 | 9cce6ffb2d84cedcc5ccf200080d6a2cab691468c042e8e48a5fdd809b5c0d067c322326e49d18f66da8e0b1d28adeda4cd03e12d7aa11350b72776737aa3427 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\en-GB.pak
| MD5 | 074d3dd44706502de7c33e791794b23a |
| SHA1 | 564a73ffad9232052c692eb94f560d6b17227c47 |
| SHA256 | 9c3954a5ca2cf126370a1152e9281f41a7ca97c69293f556a2c79ea6729324ae |
| SHA512 | 6e1296d04b16534274fa438643ecee6e37d17ed935623f73d5a8f3510a194e0efda9ca60fac8d51d25763c4818050e23c306f9ee18284b8600610d14f7768d98 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\es-419.pak
| MD5 | cadd9ec43e823609c4bbdc418da6009a |
| SHA1 | 91bdd44d5972a4763227ee7c127fe122aefe195f |
| SHA256 | 6c8d074047d57a79cf5cadf9caa6e9a64bce0895743a3dd89ed1350cc91c1e4c |
| SHA512 | 2b9eae4072e46024e33f000b1df1a64246f70498a557f4a03234d3dd47aadb04883b98ebf48eec21f0d6ca4c8a62065f675fdb352be680a56644ea3ae1db93a5 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\et.pak
| MD5 | fcdea2954549e5d8f1e7a5de36ae4f74 |
| SHA1 | 41dcdcefbbab3e0e908d98ec9b6bac7eacecbb99 |
| SHA256 | d875bca2e8800657306727902f4f5fceec7415ea530bfa780ece0f016f792569 |
| SHA512 | 37ea008078083a36b07b1f5d0ca6e16f62b06a19266d8042efc796bf33c53200f37d3a37f5b48d024dbfab9e6689ec9c3f22d6e37e3898fa7deb61ace1fb2df3 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\es.pak
| MD5 | 39288ea031009bb9db582cbd93c7d534 |
| SHA1 | 467f76d33e39526a4d8cb6068eaf8e2791b3a9ee |
| SHA256 | 6cd39669df96b4b5b9047f7689338d3beb9ad7f8be2fddc595ef1ecbc47481c2 |
| SHA512 | 4a635e969cf2b09aab5f8723a3380c5e226bf0546019506d18de65c1e4a599d268b9ee2e03a65b245075f899a09697b7b535f1055c19344a411100c8f29d93b2 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\en-US.pak
| MD5 | 0dcd84e9e50a3e0819d5875ea889ced4 |
| SHA1 | 7c47f6e4e0cafec3a13c07d689d1dd6ff6516b1e |
| SHA256 | 699b6d7f05a484e76d3e1197a656247863e570f03cc02634c9dc42078a5c5007 |
| SHA512 | 153fc15f676d78d5d0f3a6862fc7eaa60c2a659c25ce87485f0253c321d9407a9b799b959104c27a8e7b5487f0de926ae8f375e2c3d313329112e48f2d001a17 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\el.pak
| MD5 | db449f218a705453eb10b5f418e28d7b |
| SHA1 | 7bc8fcc59c532bb086a7f081cd8d275a89dac835 |
| SHA256 | 73da35d01b91707846775bea7dc0331fc1caebd5c63d101aa8bb8bb58ca7f193 |
| SHA512 | 7dce45bc723d62498b335be0ab72dfc91c44c01f96f25c2314e9245a0eab28a92dcaa730b11f108b604545592445ed1612721416f60ae3bf55b1bd438bd04f78 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\de.pak
| MD5 | fceb00caf7e76e688007665feae99e83 |
| SHA1 | 06fece84cf7028b3871f144258b8d084faf8745b |
| SHA256 | 80e63ef1950b8438813271365a7b6a3f3aba0bacc179f5675654249f31c06a3c |
| SHA512 | 08c14eb299a035949e6b64a069cadee66c420b7d66bb00d65d6a1a08fbee08a57ab08f8e77c44387f0fe02b47aeb0bf2709a1979025613cb51af4ab82fc3b6d5 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\fa.pak
| MD5 | e3f56d4b0fa2878ed6847631d3b05dea |
| SHA1 | 627f48d5423afcb3cade0789f058d60867419041 |
| SHA256 | 2ee67a38cce9ffae1a639be17c0ef7ed7c763d9c15c9621f300bf634e1f25a64 |
| SHA512 | e29c28717f31dc57c2294857680a439acec25478913ea425b0c7b6e50f3343b21fb7983c15352f9e3c001ffa0c8e500d92a1924acde32a4b5bf3f5b6c60c4142 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\fi.pak
| MD5 | 4f323a2eb73ccd029e742cee4dfa9769 |
| SHA1 | b860372d21cc55eb7ddbbf9f5bac61fed39426de |
| SHA256 | e1888472c8e1330e70e514d0a1936749a7e5d39f67e7edc818661c2cbf3e301a |
| SHA512 | d07d0f74736cd32d73b3a33867e65a25b727b5c30cb743162908e23d958fb3ae97285f600a9ef8196e61be9d450da5903d1e468fceb3b05ced93aa600387fddb |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\fil.pak
| MD5 | 693abd21a6855aeaa31f6c738c6b6fc9 |
| SHA1 | bb1fa375a9f0c682d9913b1c1610535eb2b4028d |
| SHA256 | f0bb231c710c025ad4643e2128867de6e111da867384082e7dc2d0769976b6ce |
| SHA512 | 03c68c45e3144a73251d950a8c7695e5b9c2c66711134016543ac07ee6eded723324d5312fad4624d35d0bfe9861ca4b7440d2445e6d3d6cff4a1a3cd5263c98 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\hr.pak
| MD5 | feea1754a955eb61cd41763be4e5ae2e |
| SHA1 | bb6252fec9ada8bf9ed7b81f59843d5abfcac80d |
| SHA256 | 787680ecb5d5ece246894481834b30145919c22b04d2dcad2f6ea2b2254abafb |
| SHA512 | 3d24c9ccb83f6ecf976df5cf00fdb0b46d53f09c1cb08ab68bb8d9944452785f40a761a152605708d7672f7dcb24e0b7cad1cfc14b267bf5fc1393cfd05ae4d0 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\hi.pak
| MD5 | 34bcb12c154075510d9d3066ad4a8d1f |
| SHA1 | 6a3c062221db4f391f8505892f584647b05a410a |
| SHA256 | 83c6c411d75ec5c5de6984b21fdecb07c9b926c66b67c5c99380605f6fdd8928 |
| SHA512 | aba38e4a8039bbdc46b510a8370c82d3b199b4a02da7751c162c941e6d893a9cdfc0ce92db4144ecc2b2644d58b0bc6cc7cceb0533c62c131cc55be0258c3a7f |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\he.pak
| MD5 | 6010987755f300c7984dd3f72f518ab2 |
| SHA1 | eb85f0849a86aa5fb585efaa070d2d7300b197a3 |
| SHA256 | 1c84a575e28e9a72335ed13409d6861995bd9859fd57a4d9509fe912db4a56a9 |
| SHA512 | 4b77f74d986c16524a3a6c7f60cdbe53ac5be59418737835a7fa186e4b6ee853cce8317cce352fe4064c75a7d27bf1303d76eabc53993ff1e4b7758a8ccc6228 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\gu.pak
| MD5 | 57cf11b4352e59f11b20b7ab754af031 |
| SHA1 | ca1716d419f175a2dd548929fd551dcbd1ef4bd7 |
| SHA256 | 55588f211c26e1deb47b04d39728ec051b99334c55d30252b94df57d0fba2f52 |
| SHA512 | c74360769323b3267aa218e994f49c7e135d4f320365a349a5362c1755c4b660050a070bec6c5446d4620be97a341270b6c01289db20ddf5199ece23117110a4 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\fr.pak
| MD5 | e609419893f1d885a2f17f94805a441c |
| SHA1 | 31083ac114fa4077a7da7c796ab3744873fb893f |
| SHA256 | 8d71c36d04f2d6062458aa2614f7ce223b2ee9b4665556803f764f384b191091 |
| SHA512 | 77f965f436a009a5aacebed3cc15adde5a1054e1c699b8a50b947a7e78a97cf43317d50b0ab7a42532c77d320b7393007e47199f31c58f7acb6f462f98fdd4c4 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\hu.pak
| MD5 | ae13d7ddfeb82df9950c71a4ea0bd10f |
| SHA1 | 7b55315628060668f444b110031b1fc4715bda11 |
| SHA256 | 17758e2bc746f6d770fca8969ed0aa2d00658d68792d2e8bae94d7b58665d83f |
| SHA512 | f94247fecc4fda5bdbe9732f151cdffed337eee01f59aaab6e6452c570a549dfb87c0528484c1879a04af134ac883a21043c582d0a642e185e4e64e3aff830be |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\it.pak
| MD5 | a2b9cce245e754258ea187ceb3aa2670 |
| SHA1 | 50f84fbcabea10385714a3c3a2483247ac040c02 |
| SHA256 | b72f89e5d2cacbd2db7ce28ceae35faab8c4199ec993fea64e8c78df882032d0 |
| SHA512 | 5e9cca2605d4a86d4f2b39845c8396c37f88b6f1d08c8f0e2b6f0896d60754331a588d0c0fc59e9ad8fccf0d50100a2307fff2d9df784f91537b1d9e108727ad |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\id.pak
| MD5 | b5e4e0092bd1063e8bd68d0b539ab005 |
| SHA1 | 5e3d12a6fb497687df81ed64de17b0502ea84f2a |
| SHA256 | 8d7ef1377d39fb6045c9d4b1bb064c329bd789ee33b6de530c187f1e713dd7f0 |
| SHA512 | 52b535a143bc13a03804cfda2d3f2f81f036b8d24897d1ef4a657ed290ba14e43d7cfe92c868cdef6b093b09b90119f7e50e8496eaf347c8e4fdfc13c5e306a2 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ja.pak
| MD5 | e720738027460b044429705f7ea1d25c |
| SHA1 | 851b59efad4ae074849fe41f40a56c5534caaf72 |
| SHA256 | c78fde77efbca1b3cc0cd12bda718d1a113bf6b6f3ed558b5c9a452dc974edfa |
| SHA512 | 08b0fd0ceff7ddfed26985bf84b54d75cead1f6fd4d5971da9e40996af6dc5fe9455c402f62e758020a6ccdb1ee0213cc2a5ddfa28a2bfb1e8064c6a4401c3a2 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\kn.pak
| MD5 | 90107e2353e707a6d071c9aabb5adefa |
| SHA1 | e4dfe445ca7830b3a56af38af1d73e3cb94abc73 |
| SHA256 | 9155b06ccaefbea6461f5c51e25ce25d85ca7bd557e76dae00a4d6a09a4bc424 |
| SHA512 | dead3b94638afbf4ef27e1cb5283ad2d0af73ab8996e7d2e8202ad174796121799992f577c974fc0ec53fe2b8f6fb4d37c3bef70b72c29b5b721377a0cf3b093 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\pt-BR.pak
| MD5 | 3b70cbf1aa47436b78a5e8c7672ce775 |
| SHA1 | ff9f2820e5782f9eae0ea1d5ede61665fa62cc06 |
| SHA256 | 8b4a8a3b8741610c279283a6cb843cb274223f720edac1c73296340b02569fbe |
| SHA512 | 41e3b3264d8034edf9ee1ab696ca4612ee6ef4e8537b4598805362c4a250f81274425cfa2c9c62330fed73a683e6d3b2ff537b51d869d7da19c4422728da7c0a |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\pl.pak
| MD5 | 41fd7c76e30b333027e86e20a65283a8 |
| SHA1 | 81afebdfd62255d0b0ca508141dcd7b67982f4c1 |
| SHA256 | 5de95dc2236f896e66debfe2cc7553a5bfeaa7ffea2820fe1f2f67368af84f7e |
| SHA512 | c59132dc329ee72fa8e9e9c653da597b5fa40a6eb0a7988cf62b1bdaa646a9f09f504219bfbc5af394a12c9ab6050a39740460a3e5c3ed0946b556c33f608219 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\nl.pak
| MD5 | a17bff141aec095625d0420c7a609b08 |
| SHA1 | edf3746b20ff9e3bdbf09b195e7781da1f799a91 |
| SHA256 | 7482c28c2a42a94615118b6b8cc7d002415923ca104ef86a95a4ad05c8db36b9 |
| SHA512 | 903c50c39160e40920bdcce0dc337e83b03bba00481f82ebc8ac1cf6927ebfaa75b1f9791038a71632c5e79bf7331bbf7468cc626e303929801c08f54d092c8b |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\nb.pak
| MD5 | e5546ac3407546d6b786e24c7bc21ab1 |
| SHA1 | 7a9e44a525ae005d0b41020c403c4e1e49d237b7 |
| SHA256 | 751521cbf27777bc99f2039b987686f921cb27e02c959f6cbeb976799e45066e |
| SHA512 | becf51540db5a0893e6f44d588be98142bab5c2a0f37c0212348e3cf39da52def2fd104c039229b52767a9345890f5768ed897b4bde5c6feccd75036d8b4f363 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ms.pak
| MD5 | 0bb952597b170dd4dd76e9d9d546ac3d |
| SHA1 | 101aafdf6a4ac0cdba7bd88538e7ac395e715e3e |
| SHA256 | f6721ce0d4d601ffeff011d652a9bf2518386cd8c1d2317763e37512451534ff |
| SHA512 | 46c9b63273d6ea30ee63ff230d6b5600018ae54032e04a6707f5873ebd383d0d59645f8d0b44b8ce9a4d40d5acd3453b618b9c4fd3c1b958adb5aefba3465464 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\mr.pak
| MD5 | fd3452d812a6129b8b6db620423adca0 |
| SHA1 | 9bfe47a0e9f1843c90875f28d8873d592098024c |
| SHA256 | c9704a3e528092ef676be4a653cb14b906e7c32424d59c8e4f22981014bd9111 |
| SHA512 | 7ec30343e985f7bdc6a64fc13d50bfe58ae098b03e18afeaeb4c89073059698cdf40477f2323a52c5e8f07f37b28608c54734501d14ad6ae0c9a0f2f4ab0e689 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ml.pak
| MD5 | 21aee42070f9eace2a8e14759526f05f |
| SHA1 | fedd83251a3fdb1846bf0e7e49a3a78cd77fae02 |
| SHA256 | 393d2dcd5c7c33945626fcf10ea4457649fa7b4c100c039898385133c26395cc |
| SHA512 | 60cc85a5a638d370710680bd39a6946d04660a0856bde49190fbc0002acf91617cfc3f3087a37cf592c047550ed2c5b73c2a769fbdffcacf4ad3ffa129c929e3 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\lv.pak
| MD5 | 7313fab584b7561b1fa63de07b972118 |
| SHA1 | 3a44d445f57a78867d37638a80ab39add3fcaa4a |
| SHA256 | 7b92238240c31c197029d41fdffc244f68caeb8002854f65ee3125bd95643598 |
| SHA512 | 05b067847a63c0419298616278678ade6a4fec4008323121ace5a09e22f6dae409494474f5a88adc703833691a7d4810546d012d4311e176fe58812f166b8ae3 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\lt.pak
| MD5 | 02e9c88d9d5e58d135c9a92effcce38d |
| SHA1 | 92421a5fac68d506fa904075ea7cf39a3da8efc3 |
| SHA256 | 38ad40532287da53fcdb6076b9cdb841bbb4f30162681707295bcab448149e65 |
| SHA512 | f0897d62e81eb6e2c56cf1a5b5ad5124521c345f70cab841071c7b70b16130984700d694a32dfa010460244d8b520ba1b217ffd76f75c074b5b3a9ccda26b02b |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ko.pak
| MD5 | f21c6033fa73bc7d3358c2467c9048d2 |
| SHA1 | 939f209f00e6664294872e0dc3b33a9015a2f1fb |
| SHA256 | d19cfa8ae07f23b81c0d40d7e751628844fc1aafb83d4bb4dcbe71caecf6ea2e |
| SHA512 | a4a4909ca56d3d924639cf1adab6d9ee512132c99c8e3dd37f2b949a1c816ab29ce81c01c658022e680344516201fdb0440abb97e577e6946e2731411674566d |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ro.pak
| MD5 | 4d1ed9e347de9351454d11132c06e916 |
| SHA1 | e3734d17a579ac423ec5fdc5829a211c7b76e049 |
| SHA256 | 57dc80c76c535c645893c9d3b4d0c4779aaa877445383abec79e32cf02c41276 |
| SHA512 | bd3d0841678879a24eb6f2f15c27bcb64a5d7ad171debbb51e7601a3898b830b1985b365363a01d22967969d4d4ddf89a130a5a33ff6a94cef6410b0e89f1849 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\pt-PT.pak
| MD5 | e9f8bc9fd1e845551fe3bb63c9149726 |
| SHA1 | 0bfbe46e8ffd62493c019e890a30ebc666838796 |
| SHA256 | 50cadb4da4e61fc335d145374511c34e5a0e40f9c26363614cd907cc7942a777 |
| SHA512 | 1d3761caadc3ac750c0a89c64db472bcb0764fc1c4b1108a9443fa71633ec7fdd945120a6f05e76221d9c58103cc9865b4857877d57d60b623f92a0235ed15fb |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ru.pak
| MD5 | fd441a4b72397f5d76915ebcdef45aa1 |
| SHA1 | 94a0ab5704e7303c6ef1c2ee5be0b6f4a52d146e |
| SHA256 | df41fb92e4d682d47b5adf942600b4f23c1aa5274b31b844cd4c4b6f0ec86a86 |
| SHA512 | 5fab517ec0141bb67b4b5ac868100b770fc0b7773b94f977af9205294da9305a2079327a4ece1ff1d9a3b3c805c8d8676c2b0505bf190d1c57c4ed0c14a1cfdb |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\sl.pak
| MD5 | cfb094955a5a8f655ce8a598d5a89706 |
| SHA1 | 181ace68b0c3be132ab73302ba7f7c8750f9adae |
| SHA256 | 15489195e92cf11354a9a02895aad2ba8f17aecb676dd77942054a4f3f0fd623 |
| SHA512 | a31e131663072c1192a4146321db5f0f457d27e14afc8ae40a92a4f255df4cd5302774534fed5247e145c73739a709dd5852af35750f35ecbab0fd4c1a612e2f |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\sk.pak
| MD5 | befec33f564454253ad90d6cc06ecf62 |
| SHA1 | 1fa0e082c89f9aa397551421a35b7dfc941f5250 |
| SHA256 | 9db30eeac7f1814158283affa0af6451c6f7966896cd6d6df8eab14a37e58c9f |
| SHA512 | a581faf67311eb8d81b481d1e3348f579745331f87523650a4fc35ddbe6d5033e726feab0ca3911ef76a21aceabc3e2122d16333d1b7840a933b5231a9e2d157 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\sv.pak
| MD5 | 773fc8c89b093c40191fc233730188c1 |
| SHA1 | 28001794144bdb76f62044d57e2d52c8ae1635c6 |
| SHA256 | 6aab29795a36a0234c6d447fb1fdd9011da505c348b934346a27b6a2ddb92ff3 |
| SHA512 | f9bfd3e72955104b922c34352ec16d56939eea634b9abd549d4a3342dd72f8768c85bff59814e419aee6469f6521f4f71fcfe9b8a81c1824187ba818f6d6caac |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\sr.pak
| MD5 | f4041623ce5e06d2dea58d532edb120a |
| SHA1 | 2d7ee3ef60b39e3508427c7bc12e046d7bf5e928 |
| SHA256 | f2f80d7325d259811afea1e7648c42d3ef3eebfeddaec27ee2817f4e68ab541b |
| SHA512 | 18691f4cee3eeaa2305d1c978d803fdf757d9c4e87e88e36d7b1fff482cfddd820568b39a1108065f61dd2cf10d7219c27813aad4d64e71695ab91084ec3c694 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\sw.pak
| MD5 | 70510abd3079bf26caf327989e810216 |
| SHA1 | ea640cb8b3c63d71d9b3a0d377fef5540b04fe81 |
| SHA256 | a11017a3e0e7f48338d4515ec9e79c1764387232a0d9a05fecc4b594bff40091 |
| SHA512 | ecbc97397557e27e66536a97ddf78a744c104b258d40d6f31972e6e5c6615699dd24eb02144ae0d3d53764da0f83a06f561ba95bbf08da4bf4a548b0e7f8c052 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\ta.pak
| MD5 | 8a1a245b43af1f174f262d8f53014d59 |
| SHA1 | 655045f5c71aa2589851a66d5387d4125bbce1ec |
| SHA256 | 85d8ef6fb5fdbd1d689aa6cdbbb768376b08b03ff39f7528a3804a3b4bd82af1 |
| SHA512 | d71b73fd2b5658acf5825f142130c49c278c801fd8beb5fb2039a3c209a1214a9cc00fb6896735fa4d020bc2279afca1577f35fb0a96a315631d46656d2055d3 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\th.pak
| MD5 | 96212a5191b7062d1620388acf1d09cd |
| SHA1 | d3616b6c4649dcfa347df0473e64219ccd63e63a |
| SHA256 | fa5f97bf433df481a6257fa39ef8dcc7961c5d5a83008b02c9773836d7bfc96c |
| SHA512 | 5192c36317c3a50696796c7286f77b1a02b7a0f83abb16ff7d47ec94281b85ee2fb29b9ddff7c4ad8b28a2a757772bd2bc726b10c19658ab672966679d391508 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\tr.pak
| MD5 | 4e7c047364c7c4809242741b98b28092 |
| SHA1 | 4ff1b303476cb75d8190568c346e8cc2e452da14 |
| SHA256 | 6a25be43b786ab853f8081c53012be623543830cce5ccd246ec040d98f22b852 |
| SHA512 | 4624cec04114c15a72a804fa4966fe61303effe97039337273ed0dc99e8a6a685ca5cf5fa901a84c8b219d443f1a89e6e7cbe09eb21e7ecff662301067a6cefb |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\uk.pak
| MD5 | 33f02db055c3f91148feee375acabfb7 |
| SHA1 | ca1dc284f41bc55cf35f94a4039008df9970d411 |
| SHA256 | 1968e9ed7722089330e7a8ae2c08f241aa106ed2be8948461439e6a92c330688 |
| SHA512 | ad16973e4103ced979276c6de175eb600241491ec9c441168e6375f68f8867d3f0eba422dd0ef6404208564015119f1e5e2500d5cf4ff2d8da45d713ed8c251d |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\te.pak
| MD5 | 93edec428bdaa1f84f5c9478f440997a |
| SHA1 | e03f6bd50b0e0d888f9dfbdc87c98ff567e6a91a |
| SHA256 | a499f50e452ca02ea476fab8954e7ff58d2ee0c6263b8a4657b6ebddeecd2520 |
| SHA512 | ae34e29f1e8d23dacca66036e355b12ebb1117ec6e5e99413c792a0dc8b772eb63578b2406730b014fb4ffe32b05dfd9fab8adcf38ab3f5b9bfd0cf054ed09f7 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\vi.pak
| MD5 | 98cb45f0555aee1985710196db17d72e |
| SHA1 | 1362238c253bc2a0e50c8dde6c95deb027fd6348 |
| SHA256 | 39a130557fea33a9c899f347fa3ed455e58bd51acc0b3b4586f76694b0f34646 |
| SHA512 | 93125310ade0c7029f0406aab291c35d2b7d1941f85bfd3d6071f85ff347c46e793a5ef164c08ebfcba252269a4aa84bf7a3b8779a36ee2f3da303411becc27d |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\zh-CN.pak
| MD5 | 20b6d54de42cf9c56f0a85fdc27d82e8 |
| SHA1 | cecb82b4afe8544876f443fcf578453358ab59a8 |
| SHA256 | 4140caf95939f116993ecd8bc5f7681991f96735d2397c9c7b4c66e3013eed24 |
| SHA512 | 646af407dfb85863f4555961f37f706c18b5c1e68b3111eda9f9b531ba2bb60cf67211ad634037b872156f0ddd04d50d68c49173a27a78ce59f75cbc2bb6c3bf |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\locales\zh-TW.pak
| MD5 | 03ade5ba27cd3ae9bab6ab3a5cb721c2 |
| SHA1 | a747311a5f6c2e0e535efd52bc96f3c4d12d5c3f |
| SHA256 | 0c4abf7a66026068cd4f458d504cb04f3e04cf9fae45419ddc2d592f24899a2a |
| SHA512 | 33e122328773039595248a85dc0940841a1e273957ec9a4e175871b3ada48008b608ca6569b495275abb8e2a8844ee0c4d90b48af915a3f5a6aa44f3c37e51f3 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\resources\app.asar
| MD5 | 45521cfdc0f0979a1fde10a1bf163b64 |
| SHA1 | 4f736d4fc78020a8a8df6fba1de46c95ea0c50be |
| SHA256 | b2c42f78307d22cede05b010e4cffaaa70e9ee469c8279a3399a6f497d8cde24 |
| SHA512 | d8fe5278fadd3610cd379c352c2dfd6f16f01f3e3512c364dbebc8c9fddbc933203a5e424df65f6678243f8796bc0c5b509f1c648a11989c740a5dfbb52baf31 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\resources\elevate.exe
| MD5 | 792b92c8ad13c46f27c7ced0810694df |
| SHA1 | d8d449b92de20a57df722df46435ba4553ecc802 |
| SHA256 | 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37 |
| SHA512 | 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest
| MD5 | 8951565428aa6644f1505edb592ab38f |
| SHA1 | 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2 |
| SHA256 | 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83 |
| SHA512 | 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js
| MD5 | d226502c9bf2ae0a7f029bd7930be88e |
| SHA1 | 6be773fb30c7693b338f7c911b253e4f430c2f9b |
| SHA256 | 77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f |
| SHA512 | 93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat
| MD5 | da0f40d84d72ae3e9324ad9a040a2e58 |
| SHA1 | 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f |
| SHA256 | 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b |
| SHA512 | 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\swiftshader\libGLESv2.dll
| MD5 | 1e401ccda5b723ab8a595a54f7d2531c |
| SHA1 | 127716680dd16f776b19c2306d716935e54c5100 |
| SHA256 | c167a458174e2a280c39d7af31bd109e8e2921032a687097b584653adc33ab21 |
| SHA512 | 1f2f35021f338aa7c5a0ae83c196217fbca6b1d017ac1bb4f1eebb93bd6e18c5d74c1a14bd4899d7a91d054b0139b2c4fc3271c35148ad1d8b71139aff0132fc |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\7z-out\swiftshader\libEGL.dll
| MD5 | be1b6fe26a1b5a3e1302c26ce5ce53f3 |
| SHA1 | c3cac08e89c4cc91eae1cc87e33a1dea723f1d78 |
| SHA256 | 162abe61314e720384d8cdd43190a89df8a96de52f3ede7b6c58998f615d8546 |
| SHA512 | 07dca111391dfb6b7e90d4be02071bc625128eeca0b9d9a3cebdc7916baec9f95cbbf906f2533befd6b62b9bbc69488ffa720f8d40c9710dd3b7d540d9dcaa55 |
C:\Users\Admin\AppData\Local\Temp\nsg3D77.tmp\StdUtils.dll
| MD5 | c6a6e03f77c313b267498515488c5740 |
| SHA1 | 3d49fc2784b9450962ed6b82b46e9c3c957d7c15 |
| SHA256 | b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e |
| SHA512 | 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | 1e658bd964acb133bb8732c794be06f9 |
| SHA1 | f399caf5b31603c7975c5a12dc1bf67564672021 |
| SHA256 | 186ef8a0779e155419d02ce9e8eb1cf8a5a120e50b7087b28c22d3e25a9b3191 |
| SHA512 | 34b7c565bf2cb18c33f0c0407215aa7dc0c14f4c48c49329d2e3b2e5a8d683cc6c9b1c00390d5f5fed737de8540fd286b5723270d84d09d85f8422ad4537bf7b |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\resources\app.asar
| MD5 | 50254b93bfcf9f398eb65a7aeb3b973b |
| SHA1 | d267caddb531b16de8eea79e4522d9d1d6435522 |
| SHA256 | 0d047cd771754e453e73b0bdb91df1bda1d14431054c15678a138d4dcc6782f4 |
| SHA512 | e49f1c8c0d16d4366f45882f06672f6668431d8eaafb2fd3947981672f701eb67b27d6fc8cd025487f10bfa47e24be71d9644621483338381684c9c14f876ce6 |
C:\Users\Admin\AppData\Local\Temp\d617bff8-0915-47ff-9898-3b7f65ac79d2.tmp.node
| MD5 | e4c111d47eb54b62dab8cb12540b9e39 |
| SHA1 | 09be3e7d9eec1853dc628c8c3b90e7b670921029 |
| SHA256 | a05338fe1e0eb08230717ad2f3587a5c1cb4bd10a673c40a3059f70ae0e7e6b1 |
| SHA512 | f9ec1e62c08425382b48320d2fb1a7fa412dea84825cc49b0297d5c6cfdcb80f32c54de28ac59e7a4c7557ae9900a8d3860fc7d23e486bcc28e603787d9f0f79 |
C:\Users\Admin\AppData\Local\Temp\abe76346-ab25-4a32-a587-49ec3fd0c1ac.tmp.node
| MD5 | f1e751eb4dbfa4a1b5f4903315fc535a |
| SHA1 | 85e1166819678f839954c473d7eb363a99e24a96 |
| SHA256 | b8c24de2fa870ceb677f30da0eabdf20745d0a9ebed98f49c52d881383c75096 |
| SHA512 | 2349745a84bc2b2f9c2b96999d48e37242a6c3627d7898cd9a36e682e36ec12553713db7167b3a9cd20ec308ce11d84f09f06beb3e971823d8b4a959f457b182 |
memory/2228-575-0x00007FFCF2B10000-0x00007FFCF2B11000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | c85b56af4415241d3b4b26c939bc2a02 |
| SHA1 | 477e45177fbb1a32fa44c541f15a30761a56a1b5 |
| SHA256 | 212113f8234b393778785785406c54aec426123c86cfea8d474733ce51376baf |
| SHA512 | 8e0a504da6a3af62a981caa28c6165f2bdde2780016ffd0fa1abfaba96e8c7ca0ea968327d6d7054e9985f717811d6b161bb811d878ad759b134666fa90227dd |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | f59f052384bc35b2ab984605c459e463 |
| SHA1 | dc0fd8e902aae11c9cee51db89f0488f6e376f92 |
| SHA256 | 131c7d5fa25f761f7f7ed7621543b8df439a4f84254809687266da08590969b0 |
| SHA512 | 1c585c87a61b324becab6d26903086bd8d540721ea97598f8ed1e97c4d1dac2420f2f00f1b2960682bbd4eea4dc5968656c32bf2e23ab613e99c41b08b213c23 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | 1db3378f845c053155752b13c010b999 |
| SHA1 | f8e436ccc1f0d4b0da99499548f1632158944f14 |
| SHA256 | bcd5893718ed37f2b6cea44eb4ef9de605a97db056c5731edb79238fb30ba8c1 |
| SHA512 | a612a7105cb017d7e0c72575b8d4e8671b3908e7515a17a65833701ee78311e4b2ad4f74321aef3f16621299897209f5c1d17809360b2e9c32480fb1c85cf85f |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | e7a2ec31fe9331a81a0ca7a5222b5304 |
| SHA1 | 716c13727630fb245887e07219fe2c68b84fd17d |
| SHA256 | 6c1f5aea4159c36b7ec4087dd9cd90986ba461f1f59ec6741fb9448a30aea9fa |
| SHA512 | 7d4b945a58d72bc83aee457350d91112ec38bf1316a8a91a78e701af51a378225fcb63bb3665c899ed1e783cea72e8762cfbefe81477cd4c59c3698dd623385c |
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Temp\7514cc2b-0a86-4077-9d1f-35917a3a6c1a.tmp.node
| MD5 | d4e6004197508892d18fc47645b25f62 |
| SHA1 | 1afceda2531e593c00de7ab994f928a150de5b4d |
| SHA256 | dc29d32decbd161ea4ff1e645d3fdf7a1ce3db0ee25e5485bc19fc775922b71c |
| SHA512 | 0be017eaba3764eb9f38e78248528a9e025958e713a8eb4a8f9b03d087267e107ceef8525a4ecfcbb684b077145fb0161e5dbe05f9fd95f8f94a140fe3ceb8a4 |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt
| MD5 | dec2be4f1ec3592cea668aa279e7cc9b |
| SHA1 | 327cf8ab0c895e10674e00ea7f437784bb11d718 |
| SHA256 | 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc |
| SHA512 | 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66 |
C:\Users\Admin\AppData\Local\Temp\2etPjvlaTb83Ft04XhkAGWkFvCm\Ghostbane.exe
| MD5 | bfbcb47aaad6b00bb3002bcc678e27c7 |
| SHA1 | d1c34b37bba275f3bd5f3f48c66bda1098c7f172 |
| SHA256 | b0db06fe103ae24167959c0cb193e318442ce5d25409f92d1ddb9bfae1ec37c4 |
| SHA512 | ebd54635e55e1b8008359fcfbe4e37103e4ac308f324b208a0f286ed34ad8915438f0586a87d2a0453665901ac7cc931830f0b1a43edcda3c23b1f75f3e3a6bb |
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
| MD5 | 810ae82f863a5ffae14d3b3944252a4e |
| SHA1 | 5393e27113753191436b14f0cafa8acabcfe6b2a |
| SHA256 | 453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c |
| SHA512 | 2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112 |
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC2BFB2F81ECE6429EBD768E97E5955433.TMP
| MD5 | a6f2d21624678f54a2abed46e9f3ab17 |
| SHA1 | a2a6f07684c79719007d434cbd1cd2164565734a |
| SHA256 | ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344 |
| SHA512 | 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676 |
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
| MD5 | 510150e566dc13a0e71d5e67a0004cd1 |
| SHA1 | 1a0acdfc13efa485fc056f97f1fb1f2ee281049f |
| SHA256 | 3fab5a304015241c28ae47fbc1b912fb6ee9543bcdf4b2320abdab9dc74c17ef |
| SHA512 | dfcfc0a783a969b9183d5d4d5ad111dc5616922447b5ac5ff7e6b798186b38964bdf6f3a9e28d71792d36f499a34f3560f677ae80fb3ba6ae1d1ec3b5f8fc8d9 |
memory/5224-730-0x00000000001D0000-0x00000000001DA000-memory.dmp
memory/5224-738-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/5212-747-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log
| MD5 | f3ac7a0e31b9af1b495241eff29915ad |
| SHA1 | 286fe23eba741cd3fca3f3e9a919021946655392 |
| SHA256 | f134296c53650817d3b2bbd04fd77b8833b76e79a953a1d14f7a3484bab5f12a |
| SHA512 | b21d4e091140025f7ef2e96a3e3228c788ecffe43f4bcc5d1a15826686a392d9e0ad4ead4ed19b88c92fc9fd470014b15a79b9a82878d03005da3681b8dd9210 |
memory/5212-752-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6128-770-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/5536-791-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/1324-793-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/3020-801-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6220-805-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6376-818-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6740-840-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/5516-847-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6152-851-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6720-869-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/4564-891-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6416-895-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7336-907-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7824-925-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7904-932-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7252-941-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/984-945-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/2572-935-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6220-931-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7708-930-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7764-929-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7700-927-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7756-928-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7748-924-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7764-913-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7708-906-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7156-898-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7756-897-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/7700-894-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/5764-889-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/4820-890-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6824-882-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6872-879-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6824-866-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6444-862-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/4564-861-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6852-856-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6720-852-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6996-841-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/5224-839-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/2116-834-0x000001FCF9F60000-0x000001FCFA00D000-memory.dmp
memory/6924-831-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6856-830-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6780-829-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
memory/6588-828-0x00007FFCD2110000-0x00007FFCD2BD1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2024310-3732-1lbw4qh.i29h.jpg
| MD5 | fbf7652c6ff6182d923e862dd6d288fb |
| SHA1 | bffbf12fb19f1841ed8bc844913054635dc18b03 |
| SHA256 | 04a9aaf7b8fc1d17035cb28cc62fb1bfa4ee1c0b0af6bf1b5dd44a57fa1c3f37 |
| SHA512 | 51a43a84450adcd8fbde4a5ed84baa85e9902d08cc2f4242f0635b4de2ae3e2534fe3a30f392c49cf0e037a5dae93845acef33792f9141a9c8251361f1ca931c |
memory/4456-1391-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1419-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1417-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1405-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1399-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1423-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1434-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1440-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1430-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
memory/4456-1427-0x000001D2C7C60000-0x000001D2C7C61000-memory.dmp
Analysis: behavioral19
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win10v2004-20240226-en
Max time kernel
138s
Max time network
162s
Command Line
Signatures
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.143.182.52.in-addr.arpa | udp |
Files
Analysis: behavioral20
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240221-en
Max time kernel
118s
Max time network
128s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES899A.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7A3EF8E5182405394C5BFB3289A71.TMP"
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
screenCapture_1.3.2.exe
Network
Files
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7A3EF8E5182405394C5BFB3289A71.TMP
| MD5 | a6f2d21624678f54a2abed46e9f3ab17 |
| SHA1 | a2a6f07684c79719007d434cbd1cd2164565734a |
| SHA256 | ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344 |
| SHA512 | 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676 |
C:\Users\Admin\AppData\Local\Temp\RES899A.tmp
| MD5 | 4a10d2c2d8d6ee5680787bcd6b75c325 |
| SHA1 | ea225f4cfd2737746541fc535b6202b8b9264c7f |
| SHA256 | e289bab789582102d0e2c034574d0276d102a05c2e4ccff7799be6051ec20543 |
| SHA512 | 563db2ff51a281afcfe43587803a266d934f181ae1784a934c8dc290fc5eef932b2cfd2330acc5df99334f9bf0e5a8a72cdd5cec9933ae6030507920230359b2 |
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
| MD5 | cbc021b948bfa353daea6997f4f589b0 |
| SHA1 | 0f7c16962d390011f5570facf8d0d4110437608e |
| SHA256 | 430733f08fb92d45777cec839ac5c094c50c593eeebdaab293c628d624129e9d |
| SHA512 | 2124fbf09bc78d5397f0fe4627116d26acdd45614acc5400f298e69a094783f7df24bef8b1b356216b0e84f01a22e183707e2c69bd6335b1c09df3a6d7e51349 |
memory/2664-8-0x0000000000D00000-0x0000000000D0A000-memory.dmp
memory/2664-9-0x000007FEF5720000-0x000007FEF610C000-memory.dmp
memory/2664-10-0x000007FEF5720000-0x000007FEF610C000-memory.dmp
Analysis: behavioral22
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20231129-en
Max time kernel
120s
Max time network
125s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe
"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"
Network
Files
Analysis: behavioral12
Detonation Overview
Submitted
2024-04-10 18:38
Reported
2024-04-10 18:43
Platform
win7-20240215-en
Max time kernel
121s
Max time network
126s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1