Analysis

  • max time kernel
    165s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 08:34

General

  • Target

    Ghostbane.exe

  • Size

    133.4MB

  • MD5

    21dcf914458e92f92928d52bd89470bf

  • SHA1

    cfe743e325859af219cc91b3e375b9afed58a6a9

  • SHA256

    c68227296b243230fa9cb2fc7a1d3eed54de34db04bf0a8fb6b7c04c77bf44c5

  • SHA512

    c8ccfd2cbc84b227c89e95988c51ddec76d99dd7cb06460c01c999bbe65018cd51422d9a03efa327d7e31723e0745658e47da54950959ef4e4d8d8cc9e22272c

  • SSDEEP

    1572864:42HVo9Ck+yOBBdJAVwlymAETslfp409t:G9Ctx3tu

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
    "C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic CsProduct Get UUID
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:636
    • C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
      "C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=gpu-process --field-trial-handle=1668,12479651944745129726,16166801356043990671,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 /prefetch:2
      2⤵
        PID:3184
      • C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
        "C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,12479651944745129726,16166801356043990671,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=1968 /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2756
      • C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
        "C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1668,12479651944745129726,16166801356043990671,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2464 /prefetch:1
        2⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        PID:3572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\system32\taskkill.exe
          taskkill /IM chrome.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5140
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5252
        • C:\Windows\system32\taskkill.exe
          taskkill /IM msedge.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
        2⤵
          PID:5356
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
            3⤵
              PID:5480
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
            2⤵
              PID:5364
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
                3⤵
                  PID:5496
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                2⤵
                  PID:5384
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    3⤵
                    • Enumerates processes with tasklist
                    PID:5488
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
                  2⤵
                    PID:5556
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                      3⤵
                        PID:5596
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                      2⤵
                        PID:5648
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path win32_VideoController get name
                          3⤵
                          • Detects videocard installed
                          PID:5688
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                        2⤵
                          PID:5764
                          • C:\Windows\system32\cmd.exe
                            cmd /c chcp 65001
                            3⤵
                              PID:5812
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                4⤵
                                  PID:5828
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                3⤵
                                  PID:5844
                              • C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
                                "C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1668,12479651944745129726,16166801356043990671,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --mojo-platform-channel-handle=3068 /prefetch:8
                                2⤵
                                  PID:6024
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
                                  2⤵
                                    PID:5176
                                    • C:\Windows\system32\reg.exe
                                      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
                                      3⤵
                                        PID:5320
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                      2⤵
                                        PID:5232
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist
                                          3⤵
                                          • Enumerates processes with tasklist
                                          PID:5312
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-si0jam.kpncc.jpg" "
                                        2⤵
                                          PID:4980
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                                            3⤵
                                              PID:3988
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD59.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCE7BEFB0B732C40B6B84A87D2572396BE.TMP"
                                                4⤵
                                                  PID:3240
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-deemt9.b0wnd.jpg" "
                                              2⤵
                                                PID:1012
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                                                  3⤵
                                                    PID:5452
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gkp23f.i6x4j.jpg" "
                                                  2⤵
                                                    PID:5348
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1wjx62i.sh05h.jpg" "
                                                    2⤵
                                                      PID:5524
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1hztmvx.eu83.jpg" "
                                                      2⤵
                                                        PID:2020
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9nme5r.jgvz.jpg" "
                                                        2⤵
                                                          PID:2824
                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9nme5r.jgvz.jpg"
                                                            3⤵
                                                              PID:6180
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9bj6o4.i138t.jpg" "
                                                            2⤵
                                                              PID:456
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-10qda13.vgrc.jpg" "
                                                              2⤵
                                                                PID:4932
                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-10qda13.vgrc.jpg"
                                                                  3⤵
                                                                    PID:6540
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ljehrk.kila.jpg" "
                                                                  2⤵
                                                                    PID:5488
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5bp8aq.7mhzn.jpg" "
                                                                    2⤵
                                                                      PID:5584
                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5bp8aq.7mhzn.jpg"
                                                                        3⤵
                                                                          PID:6996
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-18vyem4.khu.jpg" "
                                                                        2⤵
                                                                          PID:5840
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hnb5bl.g9cvn.jpg" "
                                                                          2⤵
                                                                            PID:5976
                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hnb5bl.g9cvn.jpg"
                                                                              3⤵
                                                                                PID:4808
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1borx4c.0mn5.jpg" "
                                                                              2⤵
                                                                                PID:5792
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-13ly4b8.ym44.jpg" "
                                                                                2⤵
                                                                                  PID:6068
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1nd2w1c.ohnxk.jpg" "
                                                                                  2⤵
                                                                                    PID:1348
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1y51te2.wnf8k.jpg" "
                                                                                    2⤵
                                                                                      PID:5984
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-6oaxsj.2qmps.jpg" "
                                                                                      2⤵
                                                                                        PID:5312
                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-6oaxsj.2qmps.jpg"
                                                                                          3⤵
                                                                                            PID:7916
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-188zwxe.jiir.jpg" "
                                                                                          2⤵
                                                                                            PID:5744
                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-188zwxe.jiir.jpg"
                                                                                              3⤵
                                                                                                PID:7924
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-65xnxl.lpdf.jpg" "
                                                                                              2⤵
                                                                                                PID:3748
                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-65xnxl.lpdf.jpg"
                                                                                                  3⤵
                                                                                                    PID:8052
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-fp6br3.9hzj.jpg" "
                                                                                                  2⤵
                                                                                                    PID:5632
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-p8rbul.2zad.jpg" "
                                                                                                    2⤵
                                                                                                      PID:5796
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-4u71t3.8gn1b.jpg" "
                                                                                                      2⤵
                                                                                                        PID:1812
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-4u71t3.8gn1b.jpg"
                                                                                                          3⤵
                                                                                                            PID:628
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hd5i3l.cwgdb.jpg" "
                                                                                                          2⤵
                                                                                                            PID:1320
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hd5i3l.cwgdb.jpg"
                                                                                                              3⤵
                                                                                                                PID:5604
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-19i6bnv.q6rm.jpg" "
                                                                                                              2⤵
                                                                                                                PID:4820
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-19i6bnv.q6rm.jpg"
                                                                                                                  3⤵
                                                                                                                    PID:3032
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-2es011.afgmf.jpg" "
                                                                                                                  2⤵
                                                                                                                    PID:3904
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-x4mm60.nyow8.jpg" "
                                                                                                                    2⤵
                                                                                                                      PID:3740
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-122q5u7.5wxb.jpg" "
                                                                                                                      2⤵
                                                                                                                        PID:6160
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-j5l7kt.kj0mn.jpg" "
                                                                                                                        2⤵
                                                                                                                          PID:6464
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1y0qkmj.n4ix.jpg" "
                                                                                                                          2⤵
                                                                                                                            PID:6560
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ub2n9e.0jgcg.jpg" "
                                                                                                                            2⤵
                                                                                                                              PID:6872
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-269ize.gf6uk.jpg" "
                                                                                                                              2⤵
                                                                                                                                PID:7100
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-269ize.gf6uk.jpg"
                                                                                                                                  3⤵
                                                                                                                                    PID:8448
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1udlto1.drr9.jpg" "
                                                                                                                                  2⤵
                                                                                                                                    PID:3540
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-75enkz.bwjw.jpg" "
                                                                                                                                    2⤵
                                                                                                                                      PID:5512
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-p4mzit.f2o3.jpg" "
                                                                                                                                      2⤵
                                                                                                                                        PID:536
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-lm92ou.3yx5.jpg" "
                                                                                                                                        2⤵
                                                                                                                                          PID:2112
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1yzxvh4.zqca.jpg" "
                                                                                                                                          2⤵
                                                                                                                                            PID:7056
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1yzxvh4.zqca.jpg"
                                                                                                                                              3⤵
                                                                                                                                                PID:8100
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1fqbjy5.9r7t.jpg" "
                                                                                                                                              2⤵
                                                                                                                                                PID:6480
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1fqbjy5.9r7t.jpg"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1156
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1dubjng.3hx2h.jpg" "
                                                                                                                                                  2⤵
                                                                                                                                                    PID:7276
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1dubjng.3hx2h.jpg"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:6208
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-17079ew.5c6k.jpg" "
                                                                                                                                                      2⤵
                                                                                                                                                        PID:7532
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-17079ew.5c6k.jpg"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:9596
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ec789i.hjp7.jpg" "
                                                                                                                                                          2⤵
                                                                                                                                                            PID:7772
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ec789i.hjp7.jpg"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5312
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1flm1pg.d968.jpg" "
                                                                                                                                                              2⤵
                                                                                                                                                                PID:7848
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1flm1pg.d968.jpg"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1348
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9hi8em.wltu8.jpg" "
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:7908
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9hi8em.wltu8.jpg"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3740
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-pfezr5.uumvg.jpg" "
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:7996
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-pfezr5.uumvg.jpg"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6736
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9lpak7.44gvf.jpg" "
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:8028
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9lpak7.44gvf.jpg"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6892
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vjul8y.2c5gm.jpg" "
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:8132
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vjul8y.2c5gm.jpg"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1468
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-fbq9qh.4x6kl.jpg" "
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:8188
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-fbq9qh.4x6kl.jpg"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:8236
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hm9blg.x4zgm.jpg" "
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:7068
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hm9blg.x4zgm.jpg"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2932
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-g8kup2.jh93g.jpg" "
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3784
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-g8kup2.jh93g.jpg"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3112
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-fcmj52.bw97l.jpg" "
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-fcmj52.bw97l.jpg"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:9620
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-146rwvv.0nhj.jpg" "
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:7000
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-146rwvv.0nhj.jpg"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6620
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-sxa9i8.gjx.jpg" "
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-sxa9i8.gjx.jpg"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:9112
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-tlgmxx.iyhg.jpg" "
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-tlgmxx.iyhg.jpg"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6464
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vyzybv.or.jpg" "
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:7804
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vyzybv.or.jpg"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-8vdamj.9oqnd.jpg" "
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-8vdamj.9oqnd.jpg"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:6156
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1y2c4d2.7x6e.jpg" "
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:8020
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1qwkfu7.aiv6.jpg" "
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1qwkfu7.aiv6.jpg"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1284
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1gypjgp.3ptce.jpg" "
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:8244
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1gypjgp.3ptce.jpg"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:8240
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-4sy6a1.wz7ml.jpg" "
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-4sy6a1.wz7ml.jpg"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:9788
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-o7kjkz.gpme.jpg" "
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:7728
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-o7kjkz.gpme.jpg"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5500
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1yiu54h.geukh.jpg" "
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1yiu54h.geukh.jpg"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:7684
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-7azxbb.hpgv.jpg" "
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-7azxbb.hpgv.jpg"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:8232
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-12yefgk.529d.jpg" "
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-12yefgk.529d.jpg"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:8060
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-46gm3c.sj8lk.jpg" "
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:7528
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-46gm3c.sj8lk.jpg"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:8740
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-110e82.ib6gca.jpg" "
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:8300
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-110e82.ib6gca.jpg"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:7944
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-zi80v.bmv6o.jpg" "
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3712
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-zi80v.bmv6o.jpg"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:7884
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-bod7bp.cnftq.jpg" "
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:5604
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-bod7bp.cnftq.jpg"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:684
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1g48fmt.luw.jpg" "
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1g48fmt.luw.jpg"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:8140
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-19ravsb.bzc.jpg" "
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:8016
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-19ravsb.bzc.jpg"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4944
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-mq331v.lyab.jpg" "
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4700
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-mq331v.lyab.jpg"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:9412
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gr98re.glecg.jpg" "
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gr98re.glecg.jpg"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4076
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1fgw99k.ytutl.jpg" "
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:6360
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1fgw99k.ytutl.jpg"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:7212
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-n8nslu.rds7d.jpg" "
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:6356
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-n8nslu.rds7d.jpg"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:9392
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1jrqkaw.h8xcf.jpg" "
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1048
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1jrqkaw.h8xcf.jpg"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5693bl.t5mco.jpg" "
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:6172
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5693bl.t5mco.jpg"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4684
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ub30q6.8khq.jpg" "
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:6388
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ub30q6.8khq.jpg"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1enves3.2rwwg.jpg" "
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:6220
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1enves3.2rwwg.jpg"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:9676
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-15ktyn1.xf4a.jpg" "
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:6572
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-15ktyn1.xf4a.jpg"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:9120
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1mft3hg.nj5k.jpg" "
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:6568
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1mft3hg.nj5k.jpg"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1coqlzl.h108.jpg" "
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:6692
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1n76csy.h5rt.jpg" "
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:6500
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1n76csy.h5rt.jpg"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:4556
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1hxmooh.iq7q.jpg" "
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:6468
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-pggy3e.yeaq.jpg" "
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:6828
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-pggy3e.yeaq.jpg"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:1588
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ld3wdn.qo5ka.jpg" "
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5252
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-e59r.f07g1a7.jpg" "
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ngnzn5.yicz.jpg" "
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1wgk0g5.hg10f.jpg" "
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:1396
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-yh354t.3c2m.jpg" "
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:8336
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-yh354t.3c2m.jpg"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1p7ivu5.8dc7.jpg" "
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:9276
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1p7ivu5.8dc7.jpg"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:10056
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9lojd1.hadzd.jpg" "
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:9344
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-djjsta.lv3x.jpg" "
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:9396
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-timh9t.f49p.jpg" "
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:9504
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-6pxrwm.673a4.jpg" "
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:9560
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-88hf4w.xp03h.jpg" "
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:9584
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1rqaf9d.aqp8.jpg" "
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9680
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-d5urvz.v4t5j.jpg" "
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:9768
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-4x2lrr.ybtwv.jpg" "
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9780
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-441kkh.6v2sd.jpg" "
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:9908
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1vmrkd6.bdqgj.jpg" "
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:10024
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1a8pk8o.ghkf.jpg" "
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:10032
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1wxd84b.0mvx.jpg" "
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:10128
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1wxd84b.0mvx.jpg"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9832
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-wa1cnq.6q08.jpg" "
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-17k0d2a.jidzi.jpg" "
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6944
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-199wv4o.0wgc.jpg" "
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6972
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1mev93v.moqzh.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8568
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-tjm8mw.mz87l.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:9816
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-tjm8mw.mz87l.jpg"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6940
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1nu9a3.05qd6g.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7448
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gvxc4n.pidif.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3188
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ebpr12.09xtq.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7780
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ebpr12.09xtq.jpg"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:10000
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-13l7cp0.ndyg.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6520
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-m09bdx.qwxe.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:10112
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-m09bdx.qwxe.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-qmnpj.nuphlj.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1cc5h3c.llxrj.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7716
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1cc5h3c.llxrj.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7352
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-q7u67a.rg1q.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-q7u67a.rg1q.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:8532
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ct72kd.r24eb.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ct72kd.r24eb.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-11idcn0.p325.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-11idcn0.p325.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8572
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1yeun6y.tjk7g.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9844
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-mkx3ko.6qeab.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-mkx3ko.6qeab.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8720
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ngdpme.r555.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Ghostbane.exe" --type=gpu-process --field-trial-handle=1668,12479651944745129726,16166801356043990671,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ghostbane" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-h0pz05.w7bvf.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-h0pz05.w7bvf.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1z4wrd.4etvd.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9972
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-o2zjru.112kl.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6636
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-o2zjru.112kl.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-he8h5r.shfrq.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8632
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-he8h5r.shfrq.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7260
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-lc8b4a.584e.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-lc8b4a.584e.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-18mxr52.g52x.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8404
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-18mxr52.g52x.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8300
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1syb4zx.4pnx.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7968
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1guj7jd.42xj.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8640
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1guj7jd.42xj.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5c0xrn.3lv9u.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8316
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5c0xrn.3lv9u.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ad5pvs.lqbgc.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-y4pjiw.83sk.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-xwe67d.8qyp.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vawg55.5mnc8.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-120u402.9d1y.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-120u402.9d1y.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-sgcu8i.0zdz.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-sgcu8i.0zdz.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1td9euv.orks.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vsk5f4.jydno.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1v0ltgc.p4a8.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1v0ltgc.p4a8.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-17pkabi.5zxp.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-dt40xo.jamnd.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-dt40xo.jamnd.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-2c3dpx.uicjw.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ffpv6u.koqh.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1mq01c6.bnao.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-kacuo8.q0a7.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-vueoy9.xxq6n.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-l0wvs1.8ciyi.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-5asl79.7dgn8.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1qiuu0k.2rkpk.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-48mygr.2g3xl.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gzlfoy.fqdj.jpg" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x4ec 0x408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-19reqmm.7cz9.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-133dfea.94uy.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ho71yv.x1s.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1gfv9do.l9ey.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-l4y455.as5.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1rvvxy3.2b9m.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1q3anmx.itdgj.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-11bo25q.wmrw.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-103otf.a6kz1l.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1xu1f8k.82oh.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-19qisus.dzdd.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-2ax5dh.jgpyo.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1uioyj3.l5hf.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1krb7g9.d03y.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gjk80r.rd0hf.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-15j9bmx.qsbp.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1wtnyv8.s3k2.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-17mjalo.ve29.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-88vaob.cfcfi.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-tdmg74.094bq.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-gd0rec.2uyg.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1wb5xlt.iqf1.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1t09h95.p9dl.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1m3ojuv.aqqk.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-ztvqje.0es6.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1uz690e.e0iz.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1mxa1yt.tl19.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1uc4xlp.0f9q.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-c2z7y6.vmzja.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1tgof5n.l1c3.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-7pzxd5.o3nbh.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-entlyq.2qrnl.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1e4ddsz.vfwq.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1c07w6x.o7oi.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-995imk.x7exs.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1lpzdb3.iwy3.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-16z9mev.kucs.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1bwgnd2.rnm7.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1qq1lf9.3aw9.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1np90dw.0jem.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-10iv2jj.sb11.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1cgj7z4.8qejl.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-rxtm1u.wyml.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1hysg2.g0hd2.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-janllp.5geli.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-12qo3d1.wxcd.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-inxwmh.auvfd.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-11euc08.r3tpl.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-xfozpo.1210e.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-kq12n5.dcvxc.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-8irwrh.i411w.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1of9zqg.n018.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1l744td.wlfc.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ovnn79.p6tr.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1w41mmy.bfvo.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1cwngwv.z35p.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1vu53qy.7mv1.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1m7lu24.ej9m.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-32f8s0.6d91i.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1xvcpks.9fws.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-hj4ylk.xp0ji.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-t0h6uf.ifzbd.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "dwm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-olgyop.3kukc.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-3coxdc.28bu8.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-8zfuty.71xad.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-15j6fhd.hz9w.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1yx560o.t7mr.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1vghrhs.4734.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1o635wi.k82y.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1s3oz03.yazw.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1ekjwdw.js0s.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-1chpecn.51dl.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024311-4172-9x7vog.4etnd.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\05288c44-28ae-41cb-829d-5291919b32f1.tmp.node

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        163KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        f1e751eb4dbfa4a1b5f4903315fc535a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        85e1166819678f839954c473d7eb363a99e24a96

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        b8c24de2fa870ceb677f30da0eabdf20745d0a9ebed98f49c52d881383c75096

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2349745a84bc2b2f9c2b96999d48e37242a6c3627d7898cd9a36e682e36ec12553713db7167b3a9cd20ec308ce11d84f09f06beb3e971823d8b4a959f457b182

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024311-4172-1hztmvx.eu83.jpg

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c87e8e11efcf9b8fd2550f467802a3c7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        0d41109d7d3529521884fbbb6455fb82272c1b9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e4963d6ba460643d3a85693c6385ec6b873773e1021a5c170660abdbcebb9d85

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260dc7b038def6c8988dd66c40c17035f3949e46c4d2542186789283c55ffbc31150c583cf976a1c6a6def52fda1f610acfc7f3ad0781f85b43ec5d8d7652d02

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8e22bb57-a842-4830-b158-bb5bbcbc9125.tmp.node

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        d4e6004197508892d18fc47645b25f62

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1afceda2531e593c00de7ab994f928a150de5b4d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dc29d32decbd161ea4ff1e645d3fdf7a1ce3db0ee25e5485bc19fc775922b71c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        0be017eaba3764eb9f38e78248528a9e025958e713a8eb4a8f9b03d087267e107ceef8525a4ecfcbb684b077145fb0161e5dbe05f9fd95f8f94a140fe3ceb8a4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RESCFB.tmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        41252f1c3ef338bbb109c59fa8c25a42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2ba25840f0454399637c1998290cb964b78d6d94

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1ea3e1ce3c56ae0c54fe87221f5a9ded9bb18a0fe1c325b65747b45fe87ed882

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259b0a8cd7bc7f21842d233249c05d07391425d2ea69d67d49de030fbac24e8c8b67d81cdee3d7123b0c79986d9d0a725a28820e06fdfc43a9af875f0700320a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        810ae82f863a5ffae14d3b3944252a4e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5393e27113753191436b14f0cafa8acabcfe6b2a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Cookies\Google Chrome_Default.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        273B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76b15962038ddc53a535e77abeed6928

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2225b888132fec7fbe1cb004c27804d339dbdeb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        12c86c7f376d7fc4d14af18418043e84bde83d7a48cd7f4468dc976e230537c6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        77ac68c8a671d098777ddbbd0ac6c3c1740b2425d27f246c983a3d93c41d2fe5f8582651c3c3287c166cd3f374c52f29c7263c3ec6f675177b2de9ba304fd497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dec2be4f1ec3592cea668aa279e7cc9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327cf8ab0c895e10674e00ea7f437784bb11d718

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fbe117eb-5617-4f68-ac0e-ae87fb9c1c24.tmp.node

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        652KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e4c111d47eb54b62dab8cb12540b9e39

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        09be3e7d9eec1853dc628c8c3b90e7b670921029

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        a05338fe1e0eb08230717ad2f3587a5c1cb4bd10a673c40a3059f70ae0e7e6b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        f9ec1e62c08425382b48320d2fb1a7fa412dea84825cc49b0297d5c6cfdcb80f32c54de28ac59e7a4c7557ae9900a8d3860fc7d23e486bcc28e603787d9f0f79

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        da0f40d84d72ae3e9324ad9a040a2e58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        879bc979896ea620f8c6b65c488dec42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13fdd14d39f45f199dfef87ccff7ce7db983ae51

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        fd4fb09864c7273a40a7474c54bf13adcb2f02e60ff78ff1dd556d092738eb22

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        88262211834a77028660c63c76b3c5f9c35986e55f49f6ebfdbd7da587c479f9b7d2d26ed2592bfb15c6ad64a901bfab2c5828b8fc28cbef2e351096f8fae9ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Ghostbane\Network Persistent State

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        393B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c78bfc02f23a43d0d80df15d1ca58d81

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        650eeb2e342160d61426e19bb6aceee5d34f77b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        0eaae20d7f25c7e6618a779344ef155a025e65941314dba9cdcf129a6c44ea1b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        bd7e6bdcccd95e5f60cd696644587dc2a65425a721349efa5315c4276dc0caa7ea98e2f4eb1e6079d0b66aa108f4da37d6ae525aa6da1ffd08e161bce88151e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Ghostbane\Network Persistent State~RFe591592.TMP

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        59B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2800881c775077e1c4b6e06bf4676de4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2873631068c8b3b9495638c865915be822442c8b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/628-373-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1396-378-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1528-265-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1652-286-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3184-12-0x00007FFE79D40000-0x00007FFE79D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3320-184-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-722-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-712-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-724-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-714-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-725-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-711-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-719-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4560-721-0x000002CFC22A0000-0x000002CFC22A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4808-275-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5364-174-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5364-164-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5372-353-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5988-177-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5992-185-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/6180-216-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/6420-260-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/6520-229-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/6996-244-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7024-285-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7028-334-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7028-319-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7224-279-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7304-294-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7540-280-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/7752-298-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/8332-367-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/8416-385-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/8424-394-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/8940-413-0x00007FFE5C580000-0x00007FFE5D041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.8MB