epsilon | 41d627b42ff2a81a4c463ae5078bd16ca2c7f23654f64b8cd17474c9d8558425

Resubmissions

Analysis

max time kernel
300s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-04-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RAM.exe
Size

651KB
MD5

7cee4e8c43b5c92d57a3d809559c92e0
SHA1

7e6a7013b0d027d58611f2cd6f461f18155ca34a
SHA256

3e93ec5cc0224e1f7c4d6eaa6a34a333526058d622a5466bbcf833f3a1ce625f
SHA512

6216619de06fd7f0e5adde4a4c8860862c265d8a9f70a077656add39a4b5eb1d87325a4d3bb579e0780a5423240356616ecb385b8b5575c09c8c79781aa445d1
SSDEEP

3072:kQJHVdFgIW9mYucJ/OD8JVsIl3rLIr67G2E1:5H7FG9mpcJ/OD8qrn

Score

10^/10

epsilon evasion persistence spyware stealer

Malware Config

Signatures

Epsilon Stealer
Information stealer.
stealer epsilon

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	UnityLibraryLinker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	UnityLibraryLinker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	UnityLibraryLinker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	UnityLibraryLinker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	UnityLibraryLinker.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UnityLibraryLinker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	UnityLibraryLinker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	UnityLibraryLinker.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	UnityLibraryLinker.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	UnityLibraryLinker.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UnityLibraryLinker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UnityLibraryLinker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	UnityLibraryLinker.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	UnityLibraryLinker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	UnityLibraryLinker.exe

Executes dropped EXE 64 IoCs

pid	Process
3312	UnityLibraryLinker.exe
4484	UnityLibraryLinker.exe
2740	UnityLibraryLinker.exe
312	UnityLibraryLinker.exe
3572	UnityLibraryLinker.exe
1408	UnityLibraryLinker.exe
3988	screenCapture_1.3.2.exe
4184	screenCapture_1.3.2.exe
4408	screenCapture_1.3.2.exe
4496	screenCapture_1.3.2.exe
192	screenCapture_1.3.2.exe
212	screenCapture_1.3.2.exe
3300	screenCapture_1.3.2.exe
432	screenCapture_1.3.2.exe
2196	screenCapture_1.3.2.exe
5116	screenCapture_1.3.2.exe
3452	screenCapture_1.3.2.exe
212	screenCapture_1.3.2.exe
3328	screenCapture_1.3.2.exe
4408	screenCapture_1.3.2.exe
5116	screenCapture_1.3.2.exe
1876	screenCapture_1.3.2.exe
2912	screenCapture_1.3.2.exe
1212	screenCapture_1.3.2.exe
2284	screenCapture_1.3.2.exe
2300	screenCapture_1.3.2.exe
2784	screenCapture_1.3.2.exe
3300	screenCapture_1.3.2.exe
4552	screenCapture_1.3.2.exe
3860	screenCapture_1.3.2.exe
980	screenCapture_1.3.2.exe
4760	screenCapture_1.3.2.exe
3300	screenCapture_1.3.2.exe
4424	screenCapture_1.3.2.exe
1432	screenCapture_1.3.2.exe
980	screenCapture_1.3.2.exe
3604	screenCapture_1.3.2.exe
5100	screenCapture_1.3.2.exe
4496	screenCapture_1.3.2.exe
2448	screenCapture_1.3.2.exe
3316	screenCapture_1.3.2.exe
1516	screenCapture_1.3.2.exe
3300	screenCapture_1.3.2.exe
4784	screenCapture_1.3.2.exe
4048	screenCapture_1.3.2.exe
1508	screenCapture_1.3.2.exe
4712	screenCapture_1.3.2.exe
4708	screenCapture_1.3.2.exe
3044	screenCapture_1.3.2.exe
2448	screenCapture_1.3.2.exe
5084	screenCapture_1.3.2.exe
4760	screenCapture_1.3.2.exe
1768	screenCapture_1.3.2.exe
4436	screenCapture_1.3.2.exe
2892	screenCapture_1.3.2.exe
2964	screenCapture_1.3.2.exe
3452	screenCapture_1.3.2.exe
4184	screenCapture_1.3.2.exe
3736	screenCapture_1.3.2.exe
1636	screenCapture_1.3.2.exe
524	screenCapture_1.3.2.exe
4180	screenCapture_1.3.2.exe
1840	screenCapture_1.3.2.exe
3096	screenCapture_1.3.2.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Wine	UnityLibraryLinker.exe

Loads dropped DLL 15 IoCs

pid	Process
3312	UnityLibraryLinker.exe
3312	UnityLibraryLinker.exe
3312	UnityLibraryLinker.exe
4484	UnityLibraryLinker.exe
4484	UnityLibraryLinker.exe
4484	UnityLibraryLinker.exe
2740	UnityLibraryLinker.exe
312	UnityLibraryLinker.exe
2740	UnityLibraryLinker.exe
2740	UnityLibraryLinker.exe
2740	UnityLibraryLinker.exe
3572	UnityLibraryLinker.exe
4484	UnityLibraryLinker.exe
1408	UnityLibraryLinker.exe
3328	UnityLibraryLinker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsUpdater.exe"	reg.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ipinfo.io
13	ipinfo.io

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	UnityLibraryLinker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4540	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4904	tasklist.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	UnityLibraryLinker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	UnityLibraryLinker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	UnityLibraryLinker.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4484	UnityLibraryLinker.exe
4484	UnityLibraryLinker.exe
312	UnityLibraryLinker.exe
312	UnityLibraryLinker.exe
3572	UnityLibraryLinker.exe
3572	UnityLibraryLinker.exe
3328	UnityLibraryLinker.exe
3328	UnityLibraryLinker.exe
3328	UnityLibraryLinker.exe
3328	UnityLibraryLinker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2724	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2724	AUDIODG.EXE
Token: SeSecurityPrivilege	3312	UnityLibraryLinker.exe
Token: SeShutdownPrivilege	4484	UnityLibraryLinker.exe
Token: SeCreatePagefilePrivilege	4484	UnityLibraryLinker.exe
Token: SeIncreaseQuotaPrivilege	4996	WMIC.exe
Token: SeSecurityPrivilege	4996	WMIC.exe
Token: SeTakeOwnershipPrivilege	4996	WMIC.exe
Token: SeLoadDriverPrivilege	4996	WMIC.exe
Token: SeSystemProfilePrivilege	4996	WMIC.exe
Token: SeSystemtimePrivilege	4996	WMIC.exe
Token: SeProfSingleProcessPrivilege	4996	WMIC.exe
Token: SeIncBasePriorityPrivilege	4996	WMIC.exe
Token: SeCreatePagefilePrivilege	4996	WMIC.exe
Token: SeBackupPrivilege	4996	WMIC.exe
Token: SeRestorePrivilege	4996	WMIC.exe
Token: SeShutdownPrivilege	4996	WMIC.exe
Token: SeDebugPrivilege	4996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4996	WMIC.exe
Token: SeRemoteShutdownPrivilege	4996	WMIC.exe
Token: SeUndockPrivilege	4996	WMIC.exe
Token: SeManageVolumePrivilege	4996	WMIC.exe
Token: 33	4996	WMIC.exe
Token: 34	4996	WMIC.exe
Token: 35	4996	WMIC.exe
Token: 36	4996	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4996	WMIC.exe
Token: SeSecurityPrivilege	4996	WMIC.exe
Token: SeTakeOwnershipPrivilege	4996	WMIC.exe
Token: SeLoadDriverPrivilege	4996	WMIC.exe
Token: SeSystemProfilePrivilege	4996	WMIC.exe
Token: SeSystemtimePrivilege	4996	WMIC.exe
Token: SeProfSingleProcessPrivilege	4996	WMIC.exe
Token: SeIncBasePriorityPrivilege	4996	WMIC.exe
Token: SeCreatePagefilePrivilege	4996	WMIC.exe
Token: SeBackupPrivilege	4996	WMIC.exe
Token: SeRestorePrivilege	4996	WMIC.exe
Token: SeShutdownPrivilege	4996	WMIC.exe
Token: SeDebugPrivilege	4996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4996	WMIC.exe
Token: SeRemoteShutdownPrivilege	4996	WMIC.exe
Token: SeUndockPrivilege	4996	WMIC.exe
Token: SeManageVolumePrivilege	4996	WMIC.exe
Token: 33	4996	WMIC.exe
Token: 34	4996	WMIC.exe
Token: 35	4996	WMIC.exe
Token: 36	4996	WMIC.exe
Token: SeShutdownPrivilege	4484	UnityLibraryLinker.exe
Token: SeCreatePagefilePrivilege	4484	UnityLibraryLinker.exe
Token: SeIncreaseQuotaPrivilege	1244	WMIC.exe
Token: SeSecurityPrivilege	1244	WMIC.exe
Token: SeTakeOwnershipPrivilege	1244	WMIC.exe
Token: SeLoadDriverPrivilege	1244	WMIC.exe
Token: SeSystemProfilePrivilege	1244	WMIC.exe
Token: SeSystemtimePrivilege	1244	WMIC.exe
Token: SeProfSingleProcessPrivilege	1244	WMIC.exe
Token: SeIncBasePriorityPrivilege	1244	WMIC.exe
Token: SeCreatePagefilePrivilege	1244	WMIC.exe
Token: SeBackupPrivilege	1244	WMIC.exe
Token: SeRestorePrivilege	1244	WMIC.exe
Token: SeShutdownPrivilege	1244	WMIC.exe
Token: SeDebugPrivilege	1244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1244	WMIC.exe
Token: SeRemoteShutdownPrivilege	1244	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4484	UnityLibraryLinker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
644	RAM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2256	644	RAM.exe	73
PID 644 wrote to memory of 2256	644	RAM.exe	73
PID 644 wrote to memory of 3312	644	RAM.exe	76
PID 644 wrote to memory of 3312	644	RAM.exe	76
PID 644 wrote to memory of 3312	644	RAM.exe	76
PID 3312 wrote to memory of 4484	3312	UnityLibraryLinker.exe	79
PID 3312 wrote to memory of 4484	3312	UnityLibraryLinker.exe	79
PID 4484 wrote to memory of 2068	4484	UnityLibraryLinker.exe	428
PID 4484 wrote to memory of 2068	4484	UnityLibraryLinker.exe	428
PID 2068 wrote to memory of 4996	2068	cmd.exe	276
PID 2068 wrote to memory of 4996	2068	cmd.exe	276
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 2740	4484	UnityLibraryLinker.exe	84
PID 4484 wrote to memory of 312	4484	UnityLibraryLinker.exe	85
PID 4484 wrote to memory of 312	4484	UnityLibraryLinker.exe	85
PID 4484 wrote to memory of 3572	4484	UnityLibraryLinker.exe	86
PID 4484 wrote to memory of 3572	4484	UnityLibraryLinker.exe	86
PID 4484 wrote to memory of 4204	4484	UnityLibraryLinker.exe	250
PID 4484 wrote to memory of 4204	4484	UnityLibraryLinker.exe	250
PID 4484 wrote to memory of 3468	4484	UnityLibraryLinker.exe	88
PID 4484 wrote to memory of 3468	4484	UnityLibraryLinker.exe	88
PID 4484 wrote to memory of 3880	4484	UnityLibraryLinker.exe	345
PID 4484 wrote to memory of 3880	4484	UnityLibraryLinker.exe	345
PID 3468 wrote to memory of 3652	3468	cmd.exe	301
PID 3468 wrote to memory of 3652	3468	cmd.exe	301
PID 4204 wrote to memory of 4648	4204	cmd.exe	338

C:\Users\Admin\AppData\Local\Temp\RAM.exe
"C:\Users\Admin\AppData\Local\Temp\RAM.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 644 1284924706816
  2⤵
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
    "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" "644" "1284924706816"
    3⤵
    PID:3136
- C:\Users\Admin\AppData\Local\Temp\UnityLibraryLinker.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityLibraryLinker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
    C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic CsProduct Get UUID
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
      "C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\UnityLibraryLinker" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1680,10750320128972914361,7199449664082551967,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
      "C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\UnityLibraryLinker" --mojo-platform-channel-handle=1804 --field-trial-handle=1680,10750320128972914361,7199449664082551967,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:312
  - - C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
      "C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\UnityLibraryLinker" --app-path="C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2168 --field-trial-handle=1680,10750320128972914361,7199449664082551967,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
        5⤵
        
        PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
        5⤵
        
        PID:3652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
      4⤵
      PID:3880
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:5024
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
      4⤵
      PID:1452
    - - C:\Windows\system32\cmd.exe
        
        cmd /c chcp 65001
        5⤵
        
        PID:2284
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3316
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
      "C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\UnityLibraryLinker" --mojo-platform-channel-handle=2752 --field-trial-handle=1680,10750320128972914361,7199449664082551967,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
      4⤵
      PID:2520
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
        5⤵
        Adds Run key to start application
        
        PID:772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      PID:3096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cswsyk.y9jp.jpg" "
      4⤵
      PID:988
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
        5⤵
        
        PID:4452
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF1C.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC197D18E8AF8749E59151D2DFF56E1728.TMP"
        6⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cswsyk.y9jp.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-10u3sd8.aqat.jpg" "
      4⤵
      PID:1208
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
        5⤵
        
        PID:2916
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFF7.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC136EE55B3CF4F9D9CDC45FB17C2FB7.TMP"
        6⤵
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o5xzw9.fe60g.jpg" "
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o5xzw9.fe60g.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-amlib0.70zs8.jpg" "
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-amlib0.70zs8.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-51iz0n.xad6w.jpg" "
      4⤵
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-51iz0n.xad6w.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bniwb.l7mh0f.jpg" "
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bniwb.l7mh0f.jpg"
        5⤵
        Executes dropped EXE
        
        PID:192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1k4dar7.jggu.jpg" "
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1k4dar7.jggu.jpg"
        5⤵
        Executes dropped EXE
        
        PID:212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-t4jio8.51ce.jpg" "
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-t4jio8.51ce.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-b4tfdi.7v1t.jpg" "
      4⤵
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-b4tfdi.7v1t.jpg"
        5⤵
        Executes dropped EXE
        
        PID:432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e4ph45.f4915.jpg" "
      4⤵
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e4ph45.f4915.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ufwmp8.fzwzg.jpg" "
      4⤵
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ufwmp8.fzwzg.jpg"
        5⤵
        Executes dropped EXE
        
        PID:5116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wp4oyd.4e9o.jpg" "
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wp4oyd.4e9o.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yne30t.ikkp.jpg" "
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yne30t.ikkp.jpg"
        5⤵
        Executes dropped EXE
        
        PID:212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-171f0h1.buzs.jpg" "
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-171f0h1.buzs.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1e84b6q.g7a6.jpg" "
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1e84b6q.g7a6.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18kjwv2.gmfjk.jpg" "
      4⤵
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18kjwv2.gmfjk.jpg"
        5⤵
        Executes dropped EXE
        
        PID:5116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-l2d5tp.l1fos.jpg" "
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-l2d5tp.l1fos.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gckpi.utgvcb.jpg" "
      4⤵
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gckpi.utgvcb.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7d33c2.jy75t.jpg" "
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7d33c2.jy75t.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iz03p7.f1nt.jpg" "
      4⤵
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iz03p7.f1nt.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ilo37k.85hal.jpg" "
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ilo37k.85hal.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1okhnen.qlsb.jpg" "
      4⤵
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1okhnen.qlsb.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1nwjna6.acv7.jpg" "
      4⤵
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1nwjna6.acv7.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o7t392.tjdo.jpg" "
      4⤵
      PID:5092
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o7t392.tjdo.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xluz1.nxy0q.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xluz1.nxy0q.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bjylm9.5mk8.jpg" "
      4⤵
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bjylm9.5mk8.jpg"
        5⤵
        Executes dropped EXE
        
        PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-180rb6s.wvhj.jpg" "
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-180rb6s.wvhj.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-npoath.x2sj.jpg" "
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-npoath.x2sj.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-julamx.pniqr.jpg" "
      4⤵
      PID:1720
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-julamx.pniqr.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdkfis.2lxrq.jpg" "
      4⤵
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdkfis.2lxrq.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-h1sf0a.3xg2.jpg" "
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-h1sf0a.3xg2.jpg"
        5⤵
        Executes dropped EXE
        
        PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3cxyz8.q4dil.jpg" "
      4⤵
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3cxyz8.q4dil.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1via2yt.a8r7.jpg" "
      4⤵
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1via2yt.a8r7.jpg"
        5⤵
        Executes dropped EXE
        
        PID:5100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-56s5p8.sluhd.jpg" "
      4⤵
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-56s5p8.sluhd.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t9lr86.k7ac.jpg" "
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t9lr86.k7ac.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uehmwe.pmae.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uehmwe.pmae.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vafd9m.cshep.jpg" "
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vafd9m.cshep.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ky6yli.nuk0l.jpg" "
      4⤵
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ky6yli.nuk0l.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17uxc94.6ke6.jpg" "
      4⤵
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17uxc94.6ke6.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19lafhr.0n9x.jpg" "
      4⤵
      PID:4496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19lafhr.0n9x.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-byeh43.nw3a.jpg" "
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-byeh43.nw3a.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1opr5po.5w0u.jpg" "
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1opr5po.5w0u.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1grp1uo.u9hu.jpg" "
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1grp1uo.u9hu.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1qnwdfv.ai2y.jpg" "
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1qnwdfv.ai2y.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p9afpj.dj8l.jpg" "
      4⤵
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p9afpj.dj8l.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdrwlp.s4io.jpg" "
      4⤵
      PID:3012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdrwlp.s4io.jpg"
        5⤵
        Executes dropped EXE
        
        PID:5084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1eq1co3.weub.jpg" "
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1eq1co3.weub.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-y0jgof.9zkn.jpg" "
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-y0jgof.9zkn.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-y1zfj.dlfp1.jpg" "
      4⤵
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-y1zfj.dlfp1.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1j4u9hb.kuhf.jpg" "
      4⤵
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1j4u9hb.kuhf.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-v3cdbg.n6nhn.jpg" "
      4⤵
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-v3cdbg.n6nhn.jpg"
        5⤵
        Executes dropped EXE
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-x4whok.oa3rb.jpg" "
      4⤵
      PID:920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-x4whok.oa3rb.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vsh6uk.vrmxa.jpg" "
      4⤵
      PID:3484
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vsh6uk.vrmxa.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-of9gvw.yaqr9.jpg" "
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-of9gvw.yaqr9.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1f5asdi.ixmh.jpg" "
      4⤵
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1f5asdi.ixmh.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o44s4u.g92lm.jpg" "
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o44s4u.g92lm.jpg"
        5⤵
        Executes dropped EXE
        
        PID:524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t6jp55.noio.jpg" "
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t6jp55.noio.jpg"
        5⤵
        Executes dropped EXE
        
        PID:4180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-an5b91.p8tau.jpg" "
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-an5b91.p8tau.jpg"
        5⤵
        Executes dropped EXE
        
        PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13jvz3.jfujse.jpg" "
      4⤵
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13jvz3.jfujse.jpg"
        5⤵
        Executes dropped EXE
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6g8sx2.uzw0q.jpg" "
      4⤵
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6g8sx2.uzw0q.jpg"
        5⤵
        
        PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1y9j178.2e8kg.jpg" "
      4⤵
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1y9j178.2e8kg.jpg"
        5⤵
        
        PID:5024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1guf2y1.2qn6.jpg" "
      4⤵
      PID:4424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1guf2y1.2qn6.jpg"
        5⤵
        
        PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1b8r07n.3trd.jpg" "
      4⤵
      PID:5056
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1b8r07n.3trd.jpg"
        5⤵
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t8qt4v.5hb1.jpg" "
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t8qt4v.5hb1.jpg"
        5⤵
        
        PID:192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rjc01x.p5tra.jpg" "
      4⤵
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rjc01x.p5tra.jpg"
        5⤵
        
        PID:4540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lo55l9.23mjc.jpg" "
      4⤵
      PID:424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lo55l9.23mjc.jpg"
        5⤵
        
        PID:4152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1f2kqi3.eq2of.jpg" "
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1f2kqi3.eq2of.jpg"
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18hu94d.omuo.jpg" "
      4⤵
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18hu94d.omuo.jpg"
        5⤵
        
        PID:4172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lwivte.zdav.jpg" "
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lwivte.zdav.jpg"
        5⤵
        
        PID:1880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uxysqs.boit.jpg" "
      4⤵
      PID:1168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uxysqs.boit.jpg"
        5⤵
        
        PID:4452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-p6959z.m32ol.jpg" "
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-p6959z.m32ol.jpg"
        5⤵
        
        PID:3476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-10szp7j.oylq.jpg" "
      4⤵
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-10szp7j.oylq.jpg"
        5⤵
        
        PID:2312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1tfy1rg.i413i.jpg" "
      4⤵
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1tfy1rg.i413i.jpg"
        5⤵
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-foca7j.1eqwl.jpg" "
      4⤵
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-foca7j.1eqwl.jpg"
        5⤵
        
        PID:5088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ko2m9g.qldem.jpg" "
      4⤵
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ko2m9g.qldem.jpg"
        5⤵
        
        PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dovhxj.o00zs.jpg" "
      4⤵
      PID:3044
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dovhxj.o00zs.jpg"
        5⤵
        
        PID:4104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-zdut56.cu9vq.jpg" "
      4⤵
      PID:4408
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-zdut56.cu9vq.jpg"
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9didpb.7fq2j.jpg" "
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9didpb.7fq2j.jpg"
        5⤵
        
        PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-x5g503.fkz3.jpg" "
      4⤵
      PID:3604
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-x5g503.fkz3.jpg"
        5⤵
        
        PID:816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cq94ab.dcsd.jpg" "
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cq94ab.dcsd.jpg"
        5⤵
        
        PID:3988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fophvq.9srg.jpg" "
      4⤵
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fophvq.9srg.jpg"
        5⤵
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wxj45j.xnn8p.jpg" "
      4⤵
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wxj45j.xnn8p.jpg"
        5⤵
        
        PID:4172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-x1r33s.wq6js.jpg" "
      4⤵
      PID:3368
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-x1r33s.wq6js.jpg"
        5⤵
        
        PID:1868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pmlio0.dh5s.jpg" "
      4⤵
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pmlio0.dh5s.jpg"
        5⤵
        
        PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-aosilc.1lk7c.jpg" "
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-aosilc.1lk7c.jpg"
        5⤵
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bc8qe9.k1m3m.jpg" "
      4⤵
      PID:4372
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bc8qe9.k1m3m.jpg"
        5⤵
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ccooxy.qybz6.jpg" "
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ccooxy.qybz6.jpg"
        5⤵
        
        PID:516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1l8ietx.59ma.jpg" "
      4⤵
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1l8ietx.59ma.jpg"
        5⤵
        
        PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17qrcan.u6yb.jpg" "
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17qrcan.u6yb.jpg"
        5⤵
        
        PID:1580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16mkbyt.m6ta.jpg" "
      4⤵
      PID:4916
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16mkbyt.m6ta.jpg"
        5⤵
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14k6xil.bm2e.jpg" "
      4⤵
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14k6xil.bm2e.jpg"
        5⤵
        
        PID:4452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pgg42p.dydf.jpg" "
      4⤵
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pgg42p.dydf.jpg"
        5⤵
        
        PID:1312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dqjqb5.56s7f.jpg" "
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dqjqb5.56s7f.jpg"
        5⤵
        
        PID:4632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cb7g5p.s3kxv.jpg" "
      4⤵
      PID:4952
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cb7g5p.s3kxv.jpg"
        5⤵
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-162kvop.s0g4.jpg" "
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-162kvop.s0g4.jpg"
        5⤵
        
        PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t6kqj4.z90c.jpg" "
      4⤵
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t6kqj4.z90c.jpg"
        5⤵
        
        PID:1580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16udy33.ab4eh.jpg" "
      4⤵
      PID:1540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16udy33.ab4eh.jpg"
        5⤵
        
        PID:1636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uz85xg.r7icl.jpg" "
      4⤵
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uz85xg.r7icl.jpg"
        5⤵
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1oos0h0.f5n8.jpg" "
      4⤵
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1oos0h0.f5n8.jpg"
        5⤵
        
        PID:4060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-188rcdm.bhkp.jpg" "
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-188rcdm.bhkp.jpg"
        5⤵
        
        PID:3604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1nuzhut.vj3qf.jpg" "
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1nuzhut.vj3qf.jpg"
        5⤵
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ejgcfy.vhra.jpg" "
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ejgcfy.vhra.jpg"
        5⤵
        
        PID:4892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11j7hzi.qnca.jpg" "
      4⤵
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11j7hzi.qnca.jpg"
        5⤵
        
        PID:872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1en8nps.scsij.jpg" "
      4⤵
      PID:1952
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1en8nps.scsij.jpg"
        5⤵
        
        PID:1876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-nqy215.nxlqn.jpg" "
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-nqy215.nxlqn.jpg"
        5⤵
        
        PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-z3arln.tdn4e.jpg" "
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-z3arln.tdn4e.jpg"
        5⤵
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-975g5y.kg4c.jpg" "
      4⤵
      PID:1904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-975g5y.kg4c.jpg"
        5⤵
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vfjql9.6m1r.jpg" "
      4⤵
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vfjql9.6m1r.jpg"
        5⤵
        
        PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1i8n50n.5gdo.jpg" "
      4⤵
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1i8n50n.5gdo.jpg"
        5⤵
        
        PID:4372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1otqbbn.3hy6i.jpg" "
      4⤵
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1otqbbn.3hy6i.jpg"
        5⤵
        
        PID:2916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1899us0.jkzm.jpg" "
      4⤵
      PID:32
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1899us0.jkzm.jpg"
        5⤵
        
        PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1aaswjp.t6k9.jpg" "
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1aaswjp.t6k9.jpg"
        5⤵
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-190d54n.t6af.jpg" "
      4⤵
      PID:4764
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-190d54n.t6af.jpg"
        5⤵
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-75gxff.98hi.jpg" "
      4⤵
      PID:1516
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:816
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-75gxff.98hi.jpg"
        5⤵
        
        PID:4132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rxsv5r.mam57.jpg" "
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rxsv5r.mam57.jpg"
        5⤵
        
        PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o6b7f9.o8e.jpg" "
      4⤵
      PID:5052
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o6b7f9.o8e.jpg"
        5⤵
        
        PID:4372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ikttdb.acbp.jpg" "
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ikttdb.acbp.jpg"
        5⤵
        
        PID:1208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14e8uth.11cg.jpg" "
      4⤵
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14e8uth.11cg.jpg"
        5⤵
        
        PID:2292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-8jatg8.rc92q.jpg" "
      4⤵
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-8jatg8.rc92q.jpg"
        5⤵
        
        PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rfi0v0.2q76r.jpg" "
      4⤵
      PID:5076
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rfi0v0.2q76r.jpg"
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1hmiid7.pqfxf.jpg" "
      4⤵
      PID:3692
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1hmiid7.pqfxf.jpg"
        5⤵
        
        PID:1452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19p6cjz.cfug.jpg" "
      4⤵
      PID:4688
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19p6cjz.cfug.jpg"
        5⤵
        
        PID:3604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-176c8hp.ulqn.jpg" "
      4⤵
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-176c8hp.ulqn.jpg"
        5⤵
        
        PID:2560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1svfdm6.stnf.jpg" "
      4⤵
      PID:3300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1svfdm6.stnf.jpg"
        5⤵
        
        PID:5052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pi7xas.hmwt.jpg" "
      4⤵
      PID:524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pi7xas.hmwt.jpg"
        5⤵
        
        PID:2788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dsksg8.5qxfa.jpg" "
      4⤵
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dsksg8.5qxfa.jpg"
        5⤵
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o5y83f.ltbkq.jpg" "
      4⤵
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o5y83f.ltbkq.jpg"
        5⤵
        
        PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1gm8ek7.0nbe.jpg" "
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1gm8ek7.0nbe.jpg"
        5⤵
        
        PID:432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ogkzmu.841bo.jpg" "
      4⤵
      PID:4764
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ogkzmu.841bo.jpg"
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ljiic6.tp2j.jpg" "
      4⤵
      PID:1136
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ljiic6.tp2j.jpg"
        5⤵
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12p1xrt.h5hnf.jpg" "
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12p1xrt.h5hnf.jpg"
        5⤵
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-zsjzbf.5tou.jpg" "
      4⤵
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-zsjzbf.5tou.jpg"
        5⤵
        
        PID:4504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ln5ggc.ksfa.jpg" "
      4⤵
      PID:3736
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ln5ggc.ksfa.jpg"
        5⤵
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1s3ist0.h5jz.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1s3ist0.h5jz.jpg"
        5⤵
        
        PID:1868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-i7enrn.9ig3.jpg" "
      4⤵
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-i7enrn.9ig3.jpg"
        5⤵
        
        PID:5092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1hwjikq.psc6l.jpg" "
      4⤵
      PID:1168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1hwjikq.psc6l.jpg"
        5⤵
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e9ww2q.ccqew.jpg" "
      4⤵
      PID:1192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e9ww2q.ccqew.jpg"
        5⤵
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-uwo27x.nbtke.jpg" "
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-uwo27x.nbtke.jpg"
        5⤵
        
        PID:4184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-36bhdb.stxcd.jpg" "
      4⤵
      PID:4532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-36bhdb.stxcd.jpg"
        5⤵
        
        PID:424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yhdovl.n9499.jpg" "
      4⤵
      PID:3696
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yhdovl.n9499.jpg"
        5⤵
        
        PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-185ca8h.cbjx.jpg" "
      4⤵
      PID:1212
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-185ca8h.cbjx.jpg"
        5⤵
        
        PID:3108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6o1urb.n3cae.jpg" "
      4⤵
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6o1urb.n3cae.jpg"
        5⤵
        
        PID:1540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1awq2cd.1gu5.jpg" "
      4⤵
      PID:4180
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:192
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1awq2cd.1gu5.jpg"
        5⤵
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x85r4h.t34p.jpg" "
      4⤵
      PID:4208
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x85r4h.t34p.jpg"
        5⤵
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sej1pt.w2jy.jpg" "
      4⤵
      PID:1380
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sej1pt.w2jy.jpg"
        5⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qkqaw.l4j6w.jpg" "
      4⤵
      PID:5100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qkqaw.l4j6w.jpg"
        5⤵
        
        PID:3520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t5q0ht.rp2r.jpg" "
      4⤵
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t5q0ht.rp2r.jpg"
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wkdum7.rbmr.jpg" "
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wkdum7.rbmr.jpg"
        5⤵
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16hr3t6.uu6q.jpg" "
      4⤵
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16hr3t6.uu6q.jpg"
        5⤵
        
        PID:3084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o0svhu.bbe3i.jpg" "
      4⤵
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o0svhu.bbe3i.jpg"
        5⤵
        
        PID:4724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xp6d7y.ikn0k.jpg" "
      4⤵
      PID:192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xp6d7y.ikn0k.jpg"
        5⤵
        
        PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xfyppo.97szf.jpg" "
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xfyppo.97szf.jpg"
        5⤵
        
        PID:4540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1n2cxio.newb.jpg" "
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1n2cxio.newb.jpg"
        5⤵
        
        PID:752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ejplx2.kksqu.jpg" "
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ejplx2.kksqu.jpg"
        5⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9x2cnb.dtlmk.jpg" "
      4⤵
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9x2cnb.dtlmk.jpg"
        5⤵
        
        PID:2772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1myv153.oodr.jpg" "
      4⤵
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1myv153.oodr.jpg"
        5⤵
        
        PID:5016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-orwl0d.wgg2d.jpg" "
      4⤵
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-orwl0d.wgg2d.jpg"
        5⤵
        
        PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16ddgkr.y8pvi.jpg" "
      4⤵
      PID:4060
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16ddgkr.y8pvi.jpg"
        5⤵
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9jhuv1.ov6fp.jpg" "
      4⤵
      PID:3316
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9jhuv1.ov6fp.jpg"
        5⤵
        
        PID:516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1amp85m.d1vz.jpg" "
      4⤵
      PID:4712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1amp85m.d1vz.jpg"
        5⤵
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x36uw6.5i6ui.jpg" "
      4⤵
      PID:3520
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x36uw6.5i6ui.jpg"
        5⤵
        
        PID:4184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pbfm6x.43dg.jpg" "
      4⤵
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pbfm6x.43dg.jpg"
        5⤵
        
        PID:3988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ls9gix.iw4c.jpg" "
      4⤵
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ls9gix.iw4c.jpg"
        5⤵
        
        PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1b670b2.hh0b.jpg" "
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1b670b2.hh0b.jpg"
        5⤵
        
        PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lxvzhn.nk47q.jpg" "
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lxvzhn.nk47q.jpg"
        5⤵
        
        PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ngpfz.k9hpip.jpg" "
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ngpfz.k9hpip.jpg"
        5⤵
        
        PID:4424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15veks8.a0vzj.jpg" "
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15veks8.a0vzj.jpg"
        5⤵
        
        PID:2364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-i3op0s.3vrbi.jpg" "
      4⤵
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-i3op0s.3vrbi.jpg"
        5⤵
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1773puh.yn93.jpg" "
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1773puh.yn93.jpg"
        5⤵
        
        PID:3520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15i5kf3.247d.jpg" "
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15i5kf3.247d.jpg"
        5⤵
        
        PID:3052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-nfx5f9.jx9vo.jpg" "
      4⤵
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-nfx5f9.jx9vo.jpg"
        5⤵
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bo7zko.y0xij.jpg" "
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bo7zko.y0xij.jpg"
        5⤵
        
        PID:4020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1k50ju1.g3pb.jpg" "
      4⤵
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1k50ju1.g3pb.jpg"
        5⤵
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1k8jx3q.u1zm.jpg" "
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1k8jx3q.u1zm.jpg"
        5⤵
        
        PID:3628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-tz83x6.vjero.jpg" "
      4⤵
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-tz83x6.vjero.jpg"
        5⤵
        
        PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11aeqma.i40j.jpg" "
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11aeqma.i40j.jpg"
        5⤵
        
        PID:872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-emxa66.d9jkg.jpg" "
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-emxa66.d9jkg.jpg"
        5⤵
        
        PID:2560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fxtixg.5y8fk.jpg" "
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fxtixg.5y8fk.jpg"
        5⤵
        
        PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lvf1kv.rtun.jpg" "
      4⤵
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lvf1kv.rtun.jpg"
        5⤵
        
        PID:1540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-takjyd.dx5q.jpg" "
      4⤵
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-takjyd.dx5q.jpg"
        5⤵
        
        PID:4460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vmw4nr.1e7tf.jpg" "
      4⤵
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vmw4nr.1e7tf.jpg"
        5⤵
        
        PID:4560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1v3fhlh.k6ui.jpg" "
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1v3fhlh.k6ui.jpg"
        5⤵
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16l671y.bobx.jpg" "
      4⤵
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16l671y.bobx.jpg"
        5⤵
        
        PID:1192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1y9sr3g.v40zl.jpg" "
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1y9sr3g.v40zl.jpg"
        5⤵
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ggligv.ux0nq.jpg" "
      4⤵
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ggligv.ux0nq.jpg"
        5⤵
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qsr5n2.1l3sa.jpg" "
      4⤵
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qsr5n2.1l3sa.jpg"
        5⤵
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xw4cap.9zeq.jpg" "
      4⤵
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xw4cap.9zeq.jpg"
        5⤵
        
        PID:3480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pa2jdc.c96t.jpg" "
      4⤵
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pa2jdc.c96t.jpg"
        5⤵
        
        PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7qv5oa.nzsjf.jpg" "
      4⤵
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7qv5oa.nzsjf.jpg"
        5⤵
        
        PID:516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1goxf5i.ovt5.jpg" "
      4⤵
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1goxf5i.ovt5.jpg"
        5⤵
        
        PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1idk6h8.y3y6.jpg" "
      4⤵
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1idk6h8.y3y6.jpg"
        5⤵
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-q619hd.qahzj.jpg" "
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-q619hd.qahzj.jpg"
        5⤵
        
        PID:4976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ae4m7m.icxv.jpg" "
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ae4m7m.icxv.jpg"
        5⤵
        
        PID:4916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdoqbl.j315.jpg" "
      4⤵
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdoqbl.j315.jpg"
        5⤵
        
        PID:2788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-v570nx.ehx5b.jpg" "
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-v570nx.ehx5b.jpg"
        5⤵
        
        PID:4172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1npuayh.zdry.jpg" "
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1npuayh.zdry.jpg"
        5⤵
        
        PID:2276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17evjw7.wi8ek.jpg" "
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17evjw7.wi8ek.jpg"
        5⤵
        
        PID:2784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fv6mec.9aa2.jpg" "
      4⤵
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fv6mec.9aa2.jpg"
        5⤵
        
        PID:4980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wwwf4x.1ag0p.jpg" "
      4⤵
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wwwf4x.1ag0p.jpg"
        5⤵
        
        PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-68m01h.454zm.jpg" "
      4⤵
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-68m01h.454zm.jpg"
        5⤵
        
        PID:3880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2ek4b5.kn5aa.jpg" "
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2ek4b5.kn5aa.jpg"
        5⤵
        
        PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1822j29.8y54h.jpg" "
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1822j29.8y54h.jpg"
        5⤵
        
        PID:2212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-127pa2o.php1f.jpg" "
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-127pa2o.php1f.jpg"
        5⤵
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sdkc8v.woak.jpg" "
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sdkc8v.woak.jpg"
        5⤵
        
        PID:4892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1rf9qtn.bes4.jpg" "
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1rf9qtn.bes4.jpg"
        5⤵
        
        PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1s3cqfp.vh3p.jpg" "
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1s3cqfp.vh3p.jpg"
        5⤵
        
        PID:3264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gmu7p0.6zah.jpg" "
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gmu7p0.6zah.jpg"
        5⤵
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-jwtgl2.m0a9b.jpg" "
      4⤵
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-jwtgl2.m0a9b.jpg"
        5⤵
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1d0bsm2.4ttgh.jpg" "
      4⤵
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1d0bsm2.4ttgh.jpg"
        5⤵
        
        PID:4432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1c6bs1i.ilhv.jpg" "
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1c6bs1i.ilhv.jpg"
        5⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6n9yja.wzj8o.jpg" "
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6n9yja.wzj8o.jpg"
        5⤵
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1slntly.09ur.jpg" "
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1slntly.09ur.jpg"
        5⤵
        
        PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p9g66g.u7xq.jpg" "
      4⤵
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p9g66g.u7xq.jpg"
        5⤵
        
        PID:3988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-chzhgz.5ksn4.jpg" "
      4⤵
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-chzhgz.5ksn4.jpg"
        5⤵
        
        PID:3364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-124n2lu.clwfh.jpg" "
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-124n2lu.clwfh.jpg"
        5⤵
        
        PID:4448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qgc6if.dqque.jpg" "
      4⤵
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qgc6if.dqque.jpg"
        5⤵
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-150vslo.svc2f.jpg" "
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-150vslo.svc2f.jpg"
        5⤵
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3z0tc6.pzbj7.jpg" "
      4⤵
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3z0tc6.pzbj7.jpg"
        5⤵
        
        PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-i042wr.tlty.jpg" "
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-i042wr.tlty.jpg"
        5⤵
        
        PID:4532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1bzj551.ieqn.jpg" "
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1bzj551.ieqn.jpg"
        5⤵
        
        PID:2212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x7o7cb.rop3.jpg" "
      4⤵
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x7o7cb.rop3.jpg"
        5⤵
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1oof6zj.dj12.jpg" "
      4⤵
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1oof6zj.dj12.jpg"
        5⤵
        
        PID:4344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-150qypz.wph2.jpg" "
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-150qypz.wph2.jpg"
        5⤵
        
        PID:1212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6dp9g7.wzo9o.jpg" "
      4⤵
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6dp9g7.wzo9o.jpg"
        5⤵
        
        PID:4208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-oawmg6.ho88e.jpg" "
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-oawmg6.ho88e.jpg"
        5⤵
        
        PID:4712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18amv9a.lnrpf.jpg" "
      4⤵
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18amv9a.lnrpf.jpg"
        5⤵
        
        PID:3880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1qbxj6a.6on7.jpg" "
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1qbxj6a.6on7.jpg"
        5⤵
        
        PID:2940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6rgki7.qopmp.jpg" "
      4⤵
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6rgki7.qopmp.jpg"
        5⤵
        
        PID:5064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-118xszi.jbb1.jpg" "
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-118xszi.jbb1.jpg"
        5⤵
        
        PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1jfga7o.a8a2.jpg" "
      4⤵
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1jfga7o.a8a2.jpg"
        5⤵
        
        PID:2248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1dru5eu.7606.jpg" "
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1dru5eu.7606.jpg"
        5⤵
        
        PID:4240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1td9iyn.dk25.jpg" "
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1td9iyn.dk25.jpg"
        5⤵
        
        PID:4548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-q3u3v2.s0hkj.jpg" "
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-q3u3v2.s0hkj.jpg"
        5⤵
        
        PID:4344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dd44jw.c69b.jpg" "
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dd44jw.c69b.jpg"
        5⤵
        
        PID:3264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ly4wvy.sn82.jpg" "
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ly4wvy.sn82.jpg"
        5⤵
        
        PID:432
  - - C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe
      "C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\UnityLibraryLinker.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\UnityLibraryLinker" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 --field-trial-handle=1680,10750320128972914361,7199449664082551967,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-31qqxh.4his4.jpg" "
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-31qqxh.4his4.jpg"
        5⤵
        
        PID:3880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3denxp.0l4ew.jpg" "
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3denxp.0l4ew.jpg"
        5⤵
        
        PID:2520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fz2cu7.kmcep.jpg" "
      4⤵
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fz2cu7.kmcep.jpg"
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3dzrsk.0xilt.jpg" "
      4⤵
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3dzrsk.0xilt.jpg"
        5⤵
        
        PID:3080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ky3hma.75zv.jpg" "
      4⤵
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ky3hma.75zv.jpg"
        5⤵
        
        PID:592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ec5m92.b71yr.jpg" "
      4⤵
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ec5m92.b71yr.jpg"
        5⤵
        
        PID:2316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1408iqm.hpaw.jpg" "
      4⤵
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1408iqm.hpaw.jpg"
        5⤵
        
        PID:2464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1q4diwp.r7ip.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1q4diwp.r7ip.jpg"
        5⤵
        
        PID:4092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9i90ws.4ftwu.jpg" "
      4⤵
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9i90ws.4ftwu.jpg"
        5⤵
        
        PID:1952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ipfl32.l86i.jpg" "
      4⤵
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ipfl32.l86i.jpg"
        5⤵
        
        PID:2312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xajdbi.o4yz.jpg" "
      4⤵
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xajdbi.o4yz.jpg"
        5⤵
        
        PID:4380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cdw0fq.wukq.jpg" "
      4⤵
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cdw0fq.wukq.jpg"
        5⤵
        
        PID:408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-m6nh9p.u82o.jpg" "
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-m6nh9p.u82o.jpg"
        5⤵
        
        PID:2196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-186ljb2.c4bz.jpg" "
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-186ljb2.c4bz.jpg"
        5⤵
        
        PID:4192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14s9yth.fput.jpg" "
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14s9yth.fput.jpg"
        5⤵
        
        PID:4400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-4eq7et.b038l.jpg" "
      4⤵
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-4eq7et.b038l.jpg"
        5⤵
        
        PID:1264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wqb74m.dhyd.jpg" "
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wqb74m.dhyd.jpg"
        5⤵
        
        PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-8tecy.dmbgpn.jpg" "
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-8tecy.dmbgpn.jpg"
        5⤵
        
        PID:2828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pmcllf.ifrw.jpg" "
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pmcllf.ifrw.jpg"
        5⤵
        
        PID:2276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1drghr0.crl5.jpg" "
      4⤵
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1drghr0.crl5.jpg"
        5⤵
        
        PID:3924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1faytv0.c3r9.jpg" "
      4⤵
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1faytv0.c3r9.jpg"
        5⤵
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1dyryio.bxwz.jpg" "
      4⤵
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1dyryio.bxwz.jpg"
        5⤵
        
        PID:4560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1a2yafq.sro3h.jpg" "
      4⤵
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1a2yafq.sro3h.jpg"
        5⤵
        
        PID:192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1jqeg8m.pz0a.jpg" "
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1jqeg8m.pz0a.jpg"
        5⤵
        
        PID:4132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-glzlij.5wwlm.jpg" "
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-glzlij.5wwlm.jpg"
        5⤵
        
        PID:820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13g8xrv.d7yx.jpg" "
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13g8xrv.d7yx.jpg"
        5⤵
        
        PID:3736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-157inur.x76d.jpg" "
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-157inur.x76d.jpg"
        5⤵
        
        PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1q98w6u.l4t2i.jpg" "
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1q98w6u.l4t2i.jpg"
        5⤵
        
        PID:4400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15z1sy.ooqz4.jpg" "
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15z1sy.ooqz4.jpg"
        5⤵
        
        PID:1264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ed6k6c.ocwj.jpg" "
      4⤵
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ed6k6c.ocwj.jpg"
        5⤵
        
        PID:4416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cbgrb0.nhz0l.jpg" "
      4⤵
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cbgrb0.nhz0l.jpg"
        5⤵
        
        PID:1472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1mpfez9.wwmf.jpg" "
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1mpfez9.wwmf.jpg"
        5⤵
        
        PID:4336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gspzt3.ypvn.jpg" "
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gspzt3.ypvn.jpg"
        5⤵
        
        PID:3920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-hr2duq.s8cdm.jpg" "
      4⤵
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-hr2duq.s8cdm.jpg"
        5⤵
        
        PID:4436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cidu1o.ag5q.jpg" "
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cidu1o.ag5q.jpg"
        5⤵
        
        PID:2292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cszji7.2pwab.jpg" "
      4⤵
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cszji7.2pwab.jpg"
        5⤵
        
        PID:4208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-c99b2y.qxwl.jpg" "
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-c99b2y.qxwl.jpg"
        5⤵
        
        PID:5052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bt8uaa.70pi7.jpg" "
      4⤵
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bt8uaa.70pi7.jpg"
        5⤵
        
        PID:4712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1w6avvr.389nk.jpg" "
      4⤵
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1w6avvr.389nk.jpg"
        5⤵
        
        PID:3468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p0fpqi.j13n.jpg" "
      4⤵
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p0fpqi.j13n.jpg"
        5⤵
        
        PID:872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xl6n56.7zib.jpg" "
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xl6n56.7zib.jpg"
        5⤵
        
        PID:4192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-u34xp7.jxzk.jpg" "
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-u34xp7.jxzk.jpg"
        5⤵
        
        PID:4400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-840zdk.8m4tc.jpg" "
      4⤵
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-840zdk.8m4tc.jpg"
        5⤵
        
        PID:4320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13fyuwv.yteb.jpg" "
      4⤵
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13fyuwv.yteb.jpg"
        5⤵
        
        PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qdlspl.1jk98.jpg" "
      4⤵
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qdlspl.1jk98.jpg"
        5⤵
        
        PID:2900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12mp9yt.0vw3f.jpg" "
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12mp9yt.0vw3f.jpg"
        5⤵
        
        PID:3240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1g1ankw.9g7f.jpg" "
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1g1ankw.9g7f.jpg"
        5⤵
        
        PID:4080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9mxpnp.34yrj.jpg" "
      4⤵
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9mxpnp.34yrj.jpg"
        5⤵
        
        PID:3260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16tvsp3.utni.jpg" "
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16tvsp3.utni.jpg"
        5⤵
        
        PID:3544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1mjcted.8htxg.jpg" "
      4⤵
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1mjcted.8htxg.jpg"
        5⤵
        
        PID:2364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lupg5p.t5gvn.jpg" "
      4⤵
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lupg5p.t5gvn.jpg"
        5⤵
        
        PID:412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-j7tab1.jyp3c.jpg" "
      4⤵
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-j7tab1.jyp3c.jpg"
        5⤵
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12zp6gi.h70m.jpg" "
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12zp6gi.h70m.jpg"
        5⤵
        
        PID:4124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1losv0t.dbyll.jpg" "
      4⤵
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1losv0t.dbyll.jpg"
        5⤵
        
        PID:3456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iafpj6.k2nfj.jpg" "
      4⤵
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iafpj6.k2nfj.jpg"
        5⤵
        
        PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9kyzxa.ko2u.jpg" "
      4⤵
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9kyzxa.ko2u.jpg"
        5⤵
        
        PID:2676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18677r1.4kcbf.jpg" "
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18677r1.4kcbf.jpg"
        5⤵
        
        PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-l9178j.cn50i.jpg" "
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-l9178j.cn50i.jpg"
        5⤵
        
        PID:1324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vjpf0l.6kqgg.jpg" "
      4⤵
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-vjpf0l.6kqgg.jpg"
        5⤵
        
        PID:3988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-m444bq.6m4k.jpg" "
      4⤵
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-m444bq.6m4k.jpg"
        5⤵
        
        PID:3040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bao5ym.fqpgd.jpg" "
      4⤵
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-bao5ym.fqpgd.jpg"
        5⤵
        
        PID:4396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-mt22jv.fqvy8.jpg" "
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-mt22jv.fqvy8.jpg"
        5⤵
        
        PID:432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wuyccm.bf0i.jpg" "
      4⤵
      PID:192
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1wuyccm.bf0i.jpg"
        5⤵
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1kftvpf.xqb8.jpg" "
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1kftvpf.xqb8.jpg"
        5⤵
        
        PID:32
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t5p7zo.4qau.jpg" "
      4⤵
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t5p7zo.4qau.jpg"
        5⤵
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-93mdc3.vov4g.jpg" "
      4⤵
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-93mdc3.vov4g.jpg"
        5⤵
        
        PID:4124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ir5ono.45hjb.jpg" "
      4⤵
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ir5ono.45hjb.jpg"
        5⤵
        
        PID:2212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lfvxi5.8cs4h.jpg" "
      4⤵
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-lfvxi5.8cs4h.jpg"
        5⤵
        
        PID:864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1itrmhj.kd6e.jpg" "
      4⤵
      PID:700
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1itrmhj.kd6e.jpg"
        5⤵
        
        PID:2488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14aa88k.v3qw.jpg" "
      4⤵
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14aa88k.v3qw.jpg"
        5⤵
        
        PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fyzw0r.g0dhp.jpg" "
      4⤵
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fyzw0r.g0dhp.jpg"
        5⤵
        
        PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1troaks.bjdd.jpg" "
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1troaks.bjdd.jpg"
        5⤵
        
        PID:4060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g491we.4aekw.jpg" "
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g491we.4aekw.jpg"
        5⤵
        
        PID:4980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1qckv3k.bpvl.jpg" "
      4⤵
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1qckv3k.bpvl.jpg"
        5⤵
        
        PID:4168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1au8vdx.w0zr.jpg" "
      4⤵
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1au8vdx.w0zr.jpg"
        5⤵
        
        PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wi1v97.jm0mf.jpg" "
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wi1v97.jm0mf.jpg"
        5⤵
        
        PID:752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1er02c7.7u9d.jpg" "
      4⤵
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1er02c7.7u9d.jpg"
        5⤵
        
        PID:424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sfusqe.0a5vo.jpg" "
      4⤵
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sfusqe.0a5vo.jpg"
        5⤵
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16u8nn1.3ixy.jpg" "
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16u8nn1.3ixy.jpg"
        5⤵
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13aqyn.3320qf.jpg" "
      4⤵
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-13aqyn.3320qf.jpg"
        5⤵
        
        PID:2248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1m16jde.cxo5h.jpg" "
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1m16jde.cxo5h.jpg"
        5⤵
        
        PID:864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pcttsw.tsb.jpg" "
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1pcttsw.tsb.jpg"
        5⤵
        
        PID:680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lzrkxn.1jt1.jpg" "
      4⤵
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lzrkxn.1jt1.jpg"
        5⤵
        
        PID:5060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p0bagg.j3sl.jpg" "
      4⤵
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1p0bagg.j3sl.jpg"
        5⤵
        
        PID:2216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19bjwpg.ev4e.jpg" "
      4⤵
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19bjwpg.ev4e.jpg"
        5⤵
        
        PID:4336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sgczst.ggqh.jpg" "
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sgczst.ggqh.jpg"
        5⤵
        
        PID:2480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fyew3d.pezdg.jpg" "
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fyew3d.pezdg.jpg"
        5⤵
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1w3ucet.ykxz.jpg" "
      4⤵
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1w3ucet.ykxz.jpg"
        5⤵
        
        PID:1768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-139bzb8.2rd8g.jpg" "
      4⤵
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-139bzb8.2rd8g.jpg"
        5⤵
        
        PID:4916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1rxi3wd.rb9h.jpg" "
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1rxi3wd.rb9h.jpg"
        5⤵
        
        PID:4608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-152dm9r.68n9.jpg" "
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-152dm9r.68n9.jpg"
        5⤵
        
        PID:512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ta9d6.rbfsq.jpg" "
      4⤵
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ta9d6.rbfsq.jpg"
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yrgr1c.ik8c.jpg" "
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yrgr1c.ik8c.jpg"
        5⤵
        
        PID:2696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-146f3kn.43sz.jpg" "
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-146f3kn.43sz.jpg"
        5⤵
        
        PID:1040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-j4ovgz.x2pda.jpg" "
      4⤵
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-j4ovgz.x2pda.jpg"
        5⤵
        
        PID:372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uas0om.m4o4j.jpg" "
      4⤵
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1uas0om.m4o4j.jpg"
        5⤵
        
        PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lu6y9h.wve8.jpg" "
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1lu6y9h.wve8.jpg"
        5⤵
        
        PID:1324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-hsep6m.7di7b.jpg" "
      4⤵
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-hsep6m.7di7b.jpg"
        5⤵
        
        PID:3116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1c2i3y3.o78j.jpg" "
      4⤵
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1c2i3y3.o78j.jpg"
        5⤵
        
        PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11gghjs.qera.jpg" "
      4⤵
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11gghjs.qera.jpg"
        5⤵
        
        PID:4204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-l4v840.uq7xt.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-l4v840.uq7xt.jpg"
        5⤵
        
        PID:4764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19e7g0j.klen.jpg" "
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19e7g0j.klen.jpg"
        5⤵
        
        PID:4504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9ucqze.m92u6.jpg" "
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9ucqze.m92u6.jpg"
        5⤵
        
        PID:3468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sedaz6.yeyo.jpg" "
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sedaz6.yeyo.jpg"
        5⤵
        
        PID:2196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-kj2ih2.86q0f.jpg" "
      4⤵
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-kj2ih2.86q0f.jpg"
        5⤵
        
        PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sbz5hs.xvuqb.jpg" "
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sbz5hs.xvuqb.jpg"
        5⤵
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-jo8xcj.1xu1a.jpg" "
      4⤵
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-jo8xcj.1xu1a.jpg"
        5⤵
        
        PID:652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1u3adum.ks0d.jpg" "
      4⤵
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1u3adum.ks0d.jpg"
        5⤵
        
        PID:4376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11cnnfh.l6o1.jpg" "
      4⤵
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11cnnfh.l6o1.jpg"
        5⤵
        
        PID:2488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yyggfj.6kjc.jpg" "
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yyggfj.6kjc.jpg"
        5⤵
        
        PID:4688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17uf173.97u.jpg" "
      4⤵
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17uf173.97u.jpg"
        5⤵
        
        PID:2184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1rom13d.gvgo.jpg" "
      4⤵
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1rom13d.gvgo.jpg"
        5⤵
        
        PID:2008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1gzrqff.zghm.jpg" "
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1gzrqff.zghm.jpg"
        5⤵
        
        PID:2784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3zhl7v.at0df.jpg" "
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3zhl7v.at0df.jpg"
        5⤵
        
        PID:3288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-137lxsb.ixmz.jpg" "
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-137lxsb.ixmz.jpg"
        5⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xypv91.jlie.jpg" "
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xypv91.jlie.jpg"
        5⤵
        
        PID:3464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sgihps.u45cq.jpg" "
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-sgihps.u45cq.jpg"
        5⤵
        
        PID:4724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1f3bgp2.7k3.jpg" "
      4⤵
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1f3bgp2.7k3.jpg"
        5⤵
        
        PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rzi61.zxc2i.jpg" "
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rzi61.zxc2i.jpg"
        5⤵
        
        PID:2264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-q33iyy.tzxze.jpg" "
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-q33iyy.tzxze.jpg"
        5⤵
        
        PID:4324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dot7fg.8t8b.jpg" "
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dot7fg.8t8b.jpg"
        5⤵
        
        PID:796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rk7oyh.22aw.jpg" "
      4⤵
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-rk7oyh.22aw.jpg"
        5⤵
        
        PID:440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-u9yq9r.8egwj.jpg" "
      4⤵
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-u9yq9r.8egwj.jpg"
        5⤵
        
        PID:216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14juuyh.uqn9.jpg" "
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14juuyh.uqn9.jpg"
        5⤵
        
        PID:2828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7cn8p7.jyrhu.jpg" "
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7cn8p7.jyrhu.jpg"
        5⤵
        
        PID:5004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ujs9fx.il2zm.jpg" "
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ujs9fx.il2zm.jpg"
        5⤵
        
        PID:2540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-4omnyi.1gbjo.jpg" "
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-4omnyi.1gbjo.jpg"
        5⤵
        
        PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1670h5a.tk53.jpg" "
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1670h5a.tk53.jpg"
        5⤵
        
        PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fvxyzs.w6q7.jpg" "
      4⤵
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fvxyzs.w6q7.jpg"
        5⤵
        
        PID:4020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-s48qz1.jh6c.jpg" "
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-s48qz1.jh6c.jpg"
        5⤵
        
        PID:4432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g5d70p.s7quc.jpg" "
      4⤵
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g5d70p.s7quc.jpg"
        5⤵
        
        PID:3628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xlf1ak.fa5.jpg" "
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xlf1ak.fa5.jpg"
        5⤵
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2z63rp.pc68k.jpg" "
      4⤵
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2z63rp.pc68k.jpg"
        5⤵
        
        PID:4184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xfnket.odla.jpg" "
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xfnket.odla.jpg"
        5⤵
        
        PID:4124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1vrspoq.jdr3.jpg" "
      4⤵
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1vrspoq.jdr3.jpg"
        5⤵
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qukhr2.gcwg.jpg" "
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qukhr2.gcwg.jpg"
        5⤵
        
        PID:524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1kt8vjl.j8b.jpg" "
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1kt8vjl.j8b.jpg"
        5⤵
        
        PID:2680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7ynhpe.fnyod.jpg" "
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7ynhpe.fnyod.jpg"
        5⤵
        
        PID:4048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dfc5vl.4rw6h.jpg" "
      4⤵
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dfc5vl.4rw6h.jpg"
        5⤵
        
        PID:3504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ljzv7s.hqpef.jpg" "
      4⤵
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ljzv7s.hqpef.jpg"
        5⤵
        
        PID:3484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdou4.2520n.jpg" "
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-pdou4.2520n.jpg"
        5⤵
        
        PID:1880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19l27dg.d2cb.jpg" "
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19l27dg.d2cb.jpg"
        5⤵
        
        PID:2956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e4vfop.dw1v.jpg" "
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e4vfop.dw1v.jpg"
        5⤵
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xx168r.k6q1h.jpg" "
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1xx168r.k6q1h.jpg"
        5⤵
        
        PID:2312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2cal4z.z7h3x.jpg" "
      4⤵
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2cal4z.z7h3x.jpg"
        5⤵
        
        PID:3316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fmj6ok.8394.jpg" "
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1fmj6ok.8394.jpg"
        5⤵
        
        PID:404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15fw1fz.gs6r.jpg" "
      4⤵
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15fw1fz.gs6r.jpg"
        5⤵
        
        PID:1540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gaphrg.xhhhb.jpg" "
      4⤵
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-gaphrg.xhhhb.jpg"
        5⤵
        
        PID:4412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sxoivg.vb5s.jpg" "
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1sxoivg.vb5s.jpg"
        5⤵
        
        PID:864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1v9cjt2.pzpn.jpg" "
      4⤵
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1v9cjt2.pzpn.jpg"
        5⤵
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18zec1h.zyhg.jpg" "
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18zec1h.zyhg.jpg"
        5⤵
        
        PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-tq0ygn.tcgbg.jpg" "
      4⤵
      PID:200
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-tq0ygn.tcgbg.jpg"
        5⤵
        
        PID:3940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ahl80u.3m66.jpg" "
      4⤵
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ahl80u.3m66.jpg"
        5⤵
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14p8ou5.9wj.jpg" "
      4⤵
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14p8ou5.9wj.jpg"
        5⤵
        
        PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fumntl.7ygfj.jpg" "
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-fumntl.7ygfj.jpg"
        5⤵
        
        PID:516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iceuoh.lnao.jpg" "
      4⤵
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iceuoh.lnao.jpg"
        5⤵
        
        PID:4088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9ywm2b.52ni7.jpg" "
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9ywm2b.52ni7.jpg"
        5⤵
        
        PID:752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-90te9u.f8g4w.jpg" "
      4⤵
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-90te9u.f8g4w.jpg"
        5⤵
        
        PID:236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yklkw0.wfr5c.jpg" "
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yklkw0.wfr5c.jpg"
        5⤵
        
        PID:1208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ieo1ml.kwjmf.jpg" "
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ieo1ml.kwjmf.jpg"
        5⤵
        
        PID:868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-b04z03.srhyf.jpg" "
      4⤵
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-b04z03.srhyf.jpg"
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7kcsfy.gv9gg.jpg" "
      4⤵
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7kcsfy.gv9gg.jpg"
        5⤵
        
        PID:2468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t1wxpq.6ru.jpg" "
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1t1wxpq.6ru.jpg"
        5⤵
        
        PID:1240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1brjd8b.5wu1.jpg" "
      4⤵
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1brjd8b.5wu1.jpg"
        5⤵
        
        PID:216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yyznuc.708a.jpg" "
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yyznuc.708a.jpg"
        5⤵
        
        PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12n354i.bcs9.jpg" "
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12n354i.bcs9.jpg"
        5⤵
        
        PID:5004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ghgv4w.s885g.jpg" "
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ghgv4w.s885g.jpg"
        5⤵
        
        PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-5sa79m.xnxlx.jpg" "
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-5sa79m.xnxlx.jpg"
        5⤵
        
        PID:3048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qrp8kg.knf2o.jpg" "
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qrp8kg.knf2o.jpg"
        5⤵
        
        PID:4892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18fbk4q.gzp7.jpg" "
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18fbk4q.gzp7.jpg"
        5⤵
        
        PID:4088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9kw4au.rb144.jpg" "
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9kw4au.rb144.jpg"
        5⤵
        
        PID:4372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7tdd8e.dnp4c.jpg" "
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7tdd8e.dnp4c.jpg"
        5⤵
        
        PID:3128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-w2z9gb.3ljb.jpg" "
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-w2z9gb.3ljb.jpg"
        5⤵
        
        PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iwz7md.r18d.jpg" "
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1iwz7md.r18d.jpg"
        5⤵
        
        PID:2696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-k47zd.khosp.jpg" "
      4⤵
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-k47zd.khosp.jpg"
        5⤵
        
        PID:2332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-935dqn.bbotj.jpg" "
      4⤵
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-935dqn.bbotj.jpg"
        5⤵
        
        PID:64
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ig48n6.htsi.jpg" "
      4⤵
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ig48n6.htsi.jpg"
        5⤵
        
        PID:3580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dq4xwo.jdjvn.jpg" "
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-dq4xwo.jdjvn.jpg"
        5⤵
        
        PID:440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-esvepd.zxli.jpg" "
      4⤵
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-esvepd.zxli.jpg"
        5⤵
        
        PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xmib5x.7m75.jpg" "
      4⤵
      PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xmib5x.7m75.jpg"
        5⤵
        
        PID:4716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1s45z6f.ym0oj.jpg" "
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1s45z6f.ym0oj.jpg"
        5⤵
        
        PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-r44pvk.7hode.jpg" "
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-r44pvk.7hode.jpg"
        5⤵
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e21t2h.0w7r.jpg" "
      4⤵
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e21t2h.0w7r.jpg"
        5⤵
        
        PID:5104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15033pe.ogkx.jpg" "
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-15033pe.ogkx.jpg"
        5⤵
        
        PID:4892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-p4wv7c.xttuj.jpg" "
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-p4wv7c.xttuj.jpg"
        5⤵
        
        PID:4088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yeaoh6.svqhf.jpg" "
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yeaoh6.svqhf.jpg"
        5⤵
        
        PID:2940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2xr8m4.fckvq.jpg" "
      4⤵
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-2xr8m4.fckvq.jpg"
        5⤵
        
        PID:3108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-10awlws.xopth.jpg" "
      4⤵
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-10awlws.xopth.jpg"
        5⤵
        
        PID:32
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1i5pehj.vm8j.jpg" "
      4⤵
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1i5pehj.vm8j.jpg"
        5⤵
        
        PID:3368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qg5a2m.engw.jpg" "
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qg5a2m.engw.jpg"
        5⤵
        
        PID:4324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3yu339.d1j75.jpg" "
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3yu339.d1j75.jpg"
        5⤵
        
        PID:4376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ap0ovk.619r7.jpg" "
      4⤵
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ap0ovk.619r7.jpg"
        5⤵
        
        PID:5060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o4tbel.hf64r.jpg" "
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-o4tbel.hf64r.jpg"
        5⤵
        
        PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16e8seq.gh3l.jpg" "
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-16e8seq.gh3l.jpg"
        5⤵
        
        PID:2096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14b2t33.wv2h.jpg" "
      4⤵
      PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-14b2t33.wv2h.jpg"
        5⤵
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-p9rbmu.7ery.jpg" "
      4⤵
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-p9rbmu.7ery.jpg"
        5⤵
        
        PID:3268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-d4p68b.0uvvk.jpg" "
      4⤵
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-d4p68b.0uvvk.jpg"
        5⤵
        
        PID:648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x7cvff.cemd.jpg" "
      4⤵
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1x7cvff.cemd.jpg"
        5⤵
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-r5i4q8.s6kw.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-r5i4q8.s6kw.jpg"
        5⤵
        
        PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19rlojd.jdxa.jpg" "
      4⤵
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19rlojd.jdxa.jpg"
        5⤵
        
        PID:4372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cv2e3v.ewa1i.jpg" "
      4⤵
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cv2e3v.ewa1i.jpg"
        5⤵
        
        PID:2364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-122pf7g.mwsf.jpg" "
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-122pf7g.mwsf.jpg"
        5⤵
        
        PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1alg6da.lhs9h.jpg" "
      4⤵
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1alg6da.lhs9h.jpg"
        5⤵
        
        PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1obqink.hcj6i.jpg" "
      4⤵
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1obqink.hcj6i.jpg"
        5⤵
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1gk9y88.wukn.jpg" "
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1gk9y88.wukn.jpg"
        5⤵
        
        PID:2420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1or92f2.rw8p.jpg" "
      4⤵
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1or92f2.rw8p.jpg"
        5⤵
        
        PID:1304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12w2evs.9mks.jpg" "
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-12w2evs.9mks.jpg"
        5⤵
        
        PID:4716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ds45ak.gmyo.jpg" "
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1ds45ak.gmyo.jpg"
        5⤵
        
        PID:3504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-142aesf.b4a9.jpg" "
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-142aesf.b4a9.jpg"
        5⤵
        
        PID:3516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-101be4m.urli.jpg" "
      4⤵
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-101be4m.urli.jpg"
        5⤵
        
        PID:2292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1misi9z.v0qg.jpg" "
      4⤵
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1misi9z.v0qg.jpg"
        5⤵
        
        PID:1508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qxsz8l.87bta.jpg" "
      4⤵
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-qxsz8l.87bta.jpg"
        5⤵
        
        PID:1192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cesu9o.23y2.jpg" "
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cesu9o.23y2.jpg"
        5⤵
        
        PID:2984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-179bhka.1fmo.jpg" "
      4⤵
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-179bhka.1fmo.jpg"
        5⤵
        
        PID:3128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e3xrf3.l8um.jpg" "
      4⤵
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-e3xrf3.l8um.jpg"
        5⤵
        
        PID:5084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1742mz.rbiwui.jpg" "
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1742mz.rbiwui.jpg"
        5⤵
        
        PID:4900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17voi8i.ci23h.jpg" "
      4⤵
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-17voi8i.ci23h.jpg"
        5⤵
        
        PID:796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-4313je.lxiro.jpg" "
      4⤵
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-4313je.lxiro.jpg"
        5⤵
        
        PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g68thy.ojjfi.jpg" "
      4⤵
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g68thy.ojjfi.jpg"
        5⤵
        
        PID:1168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g19tej.fy1j.jpg" "
      4⤵
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-g19tej.fy1j.jpg"
        5⤵
        
        PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-aorivf.1k43m.jpg" "
      4⤵
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-aorivf.1k43m.jpg"
        5⤵
        
        PID:4536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1l68mg3.igmi.jpg" "
      4⤵
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1l68mg3.igmi.jpg"
        5⤵
        
        PID:4336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-smn674.ahc1.jpg" "
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-smn674.ahc1.jpg"
        5⤵
        
        PID:4564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3br1vq.q9mxh.jpg" "
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-3br1vq.q9mxh.jpg"
        5⤵
        
        PID:2480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-d3km88.sue5v.jpg" "
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-d3km88.sue5v.jpg"
        5⤵
        
        PID:1136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1q5oj2i.lv2d.jpg" "
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1q5oj2i.lv2d.jpg"
        5⤵
        
        PID:3884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cue5z7.yftbh.jpg" "
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-cue5z7.yftbh.jpg"
        5⤵
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xxtp7.bvwco.jpg" "
      4⤵
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-xxtp7.bvwco.jpg"
        5⤵
        
        PID:512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9lekgw.gnme.jpg" "
      4⤵
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-9lekgw.gnme.jpg"
        5⤵
        
        PID:3864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19w7096.6b1g.jpg" "
      4⤵
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-19w7096.6b1g.jpg"
        5⤵
        
        PID:3084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ylj94n.inuu.jpg" "
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-ylj94n.inuu.jpg"
        5⤵
        
        PID:508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6g37a6.tte2m.jpg" "
      4⤵
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-6g37a6.tte2m.jpg"
        5⤵
        
        PID:2316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7t0wds.dhnji.jpg" "
      4⤵
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-7t0wds.dhnji.jpg"
        5⤵
        
        PID:3364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11hnml5.02lt.jpg" "
      4⤵
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-11hnml5.02lt.jpg"
        5⤵
        
        PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-137u14d.ucbti.jpg" "
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-137u14d.ucbti.jpg"
        5⤵
        
        PID:2204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yc4wkv.f7oy.jpg" "
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-1yc4wkv.f7oy.jpg"
        5⤵
        
        PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yc8x7c.uahr.jpg" "
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-yc8x7c.uahr.jpg"
        5⤵
        
        PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wy618.vn1szd.jpg" "
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-wy618.vn1szd.jpg"
        5⤵
        
        PID:1212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18stdis.y4he.jpg" "
      4⤵
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
        
        screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024313-4484-18stdis.y4he.jpg"
        5⤵
        
        PID:1136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log

Filesize
862B

MD5
a22c21f75b90e4842a18efcbd5ff792b

SHA1
c31c1e79be641f30b6ebf14adbd4363ceebc1991

SHA256
6482b762db454935a9c9af80b93f96bb7406a4931e6c78df785639667eaf545d

SHA512
a64489b6ad5089d164b136862ae4dce8dc35a51b2934625b88db6296b2da4fba989c3366814f56093ba923f9a290b10ac9ea2cb334da0ac85380914452e5bde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024313-4484-1cswsyk.y9jp.jpg

Filesize
28KB

MD5
df763908b9a1486486d36629e0207bef

SHA1
5e8a3db44af61ab7184782a5c648d842f55d6aa7

SHA256
dc48729e855cd39a343f6ab08fc35fe10ba5478f4e81bc418c9d6395704fc76c

SHA512
106c568bff6b75a19b73b903575ff612266940923b83e3f1ee9f619048b5b6607f8595d580098cb63a83b1a99afc61ba375918a4f0f7379cc076a09f5fdc861f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f3f2BXKt5VIdUX5xEyM40e7HoS\chrome_100_percent.pak

Filesize
138KB

MD5
9c1b859b611600201ccf898f1eff2476

SHA1
87d5d9a5fcc2496b48bb084fdf04331823dd1699

SHA256
53102833760a725241841312de452c45e43edd60a122546105ab4020ccef591b

SHA512
1a8ec288e53b9d7e43d018995abe4e3d9c83d329d0561fbb7d022e8b79ffecf033e995b9bc6af352a71c646a1e8afba4addb54deab7455f24b7a279a3dd7c336

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAF1C.tmp

Filesize
1KB

MD5
5873d4f844cb56ce570f0bb7b62f5f8f

SHA1
7ea57b2340798b906b06a8274007b56472a8d1f7

SHA256
fe5103d30d6cba72c371dca765a97c61df721e39f078b1090caa049a992580a9

SHA512
b7aa41dbae79405e1bc196d155efefac3b434052785a63bc5f0500e7b1179cd7a5535e3ea1a6a4ca1da83b8212628c3292b37862c4e53bfb7e6cc3edb163742a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAFF7.tmp

Filesize
1KB

MD5
f4e571a00be2f8de010ad8c33ba287a6

SHA1
7e08104d30dcebb61f2be8191696a308cd6cb7cb

SHA256
b9c16d67b02bbd862adf6ec807229bb5301f47de01645976ded328bd2a616064

SHA512
de07249b231b25e44d27213fddd42fc736b6a4781f9a4b81a6918a0a571cf3112e943d4c5653c2cc9357a6d88830e0e8d071775fca379bc43785df5089d8ae9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnityLibraryLinker.exe

Filesize
69.9MB

MD5
28d7b473299e9abb469976add676cbb1

SHA1
f60af3ab4653f12f01f1b61eb518e103bdb3b0e0

SHA256
b0d6fb77b2eb5e09ea9a59713497cd8956447c0d36685c8a42032804afcddfde

SHA512
cfc7d045e0bd530ebff43a587d0dc13dd6f16356a7ccd65e4f4c1758ed5ecb92b64a808375f89da4089d3d996f04313a20769ab3433056f64427900e9a8ca0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

Filesize
240B

MD5
810ae82f863a5ffae14d3b3944252a4e

SHA1
5393e27113753191436b14f0cafa8acabcfe6b2a

SHA256
453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c

SHA512
2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\LICENSES.chromium.html

Filesize
5.2MB

MD5
df37c89638c65db9a4518b88e79350be

SHA1
6b9ba9fba54fb3aa1b938de218f549078924ac50

SHA256
dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463

SHA512
93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\UnityLibraryLinker.exe

Filesize
139.8MB

MD5
3f07334dc5144f7e22b4aca05223502b

SHA1
77d8ac3a2706a27ef4d93b84c855d145cf01c75d

SHA256
7d9ed7ca12f61c1095af46fb7d33dd66c437553eafa4c088a9d88c40a77e61fb

SHA512
bd9234a6969ffb121a5875c72e4dc446e6923d6944e7d7d7b6c989ba65c0bf96a352307d7b392a9bddb0eefa13bd4b83272b5fdd7ff184caebbf2b48cb2bcccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\chrome_200_percent.pak

Filesize
202KB

MD5
b51a78961b1dbb156343e6e024093d41

SHA1
51298bfe945a9645311169fc5bb64a2a1f20bc38

SHA256
4a438f0e209ac62ffa2c14036efdd5474b5ecaa7cbf54110f2e6153abdfb8be9

SHA512
23dedde25ad9cb5829d4b6092a815712788698c2a5a0aefb4299675d39f8b5e2844eabd1ea42332a0408bd234548f5af628e7e365ab26f3385ebfa158cdd921d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
12cb29b61007fd6cd166882635241038

SHA1
31bacefd2d7238fb5ac77f728bb39a27b400dbb0

SHA256
2e60bc5a05d3e98d12d2bd577d63b6dc77bd1b3734633259fcaf50fa3688ca9c

SHA512
cbfab7708a01fe47904facfdf9604025d6f1c680e40ada0b4c1b1ef35a4eab7de5de96c22d0491c6d202175d2c66693216efab6cfab73e316d466811d834b126

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\icudtl.dat

Filesize
9.8MB

MD5
599c39d9adb88686c4585b15fb745c0e

SHA1
2215eb6299aa18e87db21f686b08695a5199f4e2

SHA256
c5f82843420fa9d144e006b48d59ba7ef95f7e6cb1ea95b27fcdd2c97f850859

SHA512
16194186a8407b29f799d4b02f5674e4fbd5d91163fad9f8dce6ceedd865b754a681aa960d0f3f1b62cb21d5443879f1b8e9b691c19c5802d5bdfe4ed645b8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\libEGL.dll

Filesize
437KB

MD5
979b72ca6e98fc7fdcfcc50d77906fb5

SHA1
dc4b874f495ed73c90b39feb566a48a081371c4b

SHA256
73d1f5880980a2ccb8e5a15e285a4a11fccd80754829e85aa9a3b8ffecf39dd9

SHA512
bd4d25a591d1c52d9a4a850a5bccbbf5ec8d174f5f093c0fd611a18af8d337b918464220a4f9591d03582aadf1c9cb392596a5449fb7d0a928889b0f65f8c619

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\libGLESv2.dll

Filesize
6.7MB

MD5
5300049a47fd88310ef94f9e37eeb247

SHA1
89672d16382a75781eeca002c850c17cfc46e851

SHA256
33863ea4047e4eaae8f24bfa3491bb809d4c3d44489ae2bbe5e3af9e5cc1fe50

SHA512
b38ef83cb40923654ae1efcdb8af63e1fb47f640a0cbeac350b97f24da1365da23d757cacef1f9e994ace0b076b4bc1408644347aec3c94995bb27d184a93c09

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\am.pak

Filesize
180KB

MD5
b319cd4192f5bd03bab4644ee51e4ebc

SHA1
49c52f43f542022a97d2ae18a56a266deb901496

SHA256
ab1d0f3bedb5806fa7268773b6193928cdb40e641d8563c14df1bf962434d5f2

SHA512
3fe8284422bb7de7f2e3e121b8657b7686586d597b4d453b2e38f119fd25bddd61c1218f22cc8e4bbf37f393411bb866c0d6c166207b5bbfeb45f5459e29e370

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ar.pak

Filesize
185KB

MD5
d7eecfb7cc52b3dfb69d8047dc6aa12d

SHA1
fa5e4e98395c4bb14259c2e3c36fc84b55f0c3d5

SHA256
e38cd21fb917db4671ab331ee505948e109e2a0c6a2f3ad0e64d09863efb7df8

SHA512
2ebc6f7749e50bb3a9c27d2235be1478fc2d58a7b6f5c4cbbda09ad4f28ee3873881dda16ea668eeb63dd259a23ac68c73e4ab4295d51a22c36284d9c8667ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\bg.pak

Filesize
202KB

MD5
8448caa7a70f74dc0c6e453e7487bedb

SHA1
a7f67df94ee9532d26c6e6e827d61414f4516d0c

SHA256
19f49a247dfa1328799a1be9a556d940618ceefc04a5dfd813e5c023d086a41a

SHA512
337293839e64f514152c7558f2d1cbb301730675936ecfc11242d1346c9da535896dddaa8ad563a40303cdc8884f80af679c324b31325d40b7141a8738ab14bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\bn.pak

Filesize
261KB

MD5
124d35950327fec461c07dfb6dde72eb

SHA1
f3d7791dd6bdf88f65a62ec2e8170ee445b6a37a

SHA256
def934201f35a643c8b097be42fe86f2a08cef5523cb61e2d94cb33ae373f502

SHA512
05a993c9ba52083b8a7f0b3662eb8e4a873d23f309d334cb4e4088fa5e33d8503fdc6d19f247c4920cdd91a165995c514b2a061c26fc44f89e864516ffdde9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ca.pak

Filesize
126KB

MD5
90d8b16ace2fc684d0ddde0d71f64831

SHA1
ead7dbeffb3c102d3547c8c256135991b547ade9

SHA256
020350f4a902c79e0f1f5366e209b2c309ac51b6e72d9ccf51cdde2fab756e3e

SHA512
bfeec65e7c001d7a29c18e6bfc2b4c6688c828419d0e9823d524a7b35c24a3303c1cfb8f14a98d965d4ab41c5110842ec64cb7a2928309b0bd31291e85b168b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\cs.pak

Filesize
129KB

MD5
2c9e55ed46954a8eaa27105f3f074ca2

SHA1
bb4a36964cd1e8f140c9937586b5215fbd7a9632

SHA256
86f1847450d5c341893fa097fa6d4e0964963c0c2466a985d014dab0b65f34e6

SHA512
cf7141a3db9d44c0940e88ded1f326b5ca4031d18f8a8236b313c6a6c41289e9dfd12c3367181edcbd5425deb584b082df004bd6db0ca55a1da151703af575bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\da.pak

Filesize
117KB

MD5
66e780528890dc0f484a3d6938ac281a

SHA1
5f46f7915cf101b88d29213b457f37e24d5a083e

SHA256
e698945093c1f562d0e591c03d9670a9b01d0eaa56a2c80c1d12d91d88b7b407

SHA512
9cbc2b054bd3f9d39050a4a189fcf0127a43b9991ecdc9453679c53b38cf8a25138057648a756e01fc9b4825c009a8894ef68b94faca83cd35d268fb05556af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\de.pak

Filesize
127KB

MD5
8e560e240bb79e453167f70409226619

SHA1
bde183d2191d42797a300f0c4cd83e1db278c928

SHA256
61c4a4b5c309128ba86a5345db04798be0680905543c6986f7b3cc4b1ba72729

SHA512
5564555eb203fe86e9630dc223e4012c7e3501d68554b6b7138a3c6064d39b868e7e2e0e8b994169e918e9c6f67066440b89c7ab10f48731a84fab84c2e7ff82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\el.pak

Filesize
223KB

MD5
b3724a4dcb17bd341da403acfdff0bf5

SHA1
05fc9eb29381f1befbafb937c564a87205779264

SHA256
0adb6e5173572ab4a3df5671cf053196f158294bc1e07275a7e6fb6d8da81b06

SHA512
3ccd57eb43840573bbd7e6d8b24028213acf58040b2795a975ca4750e4a9500d8af74bebac1b47f2d9b87204c68707d53b0d927c0aeac1fa1bfdb1c899e66f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\en-GB.pak

Filesize
102KB

MD5
05f7b55019ba0a9da84073cec0a954c3

SHA1
b46462fa8c614161ec42fa791e4ce3163c92ea8c

SHA256
a690e642a6b781efc3da2e8c83e554d6e8b9ae6ac34f6f0a4f327dd9ea7cb7f1

SHA512
30e93503db60b8c7a8dc902efa960583316cb83337eca102f0bdafc47d3b59ad5ea1eb99b5b9deb0ff66345d551485963e4c61ce555298880aafcd298057fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\en-US.pak

Filesize
103KB

MD5
b58cb46758c6bc8fe4385ec2ce4e50b7

SHA1
34026e96e02220cea46a31c2319f695ca2e0a914

SHA256
e34c459684971971765943e8b5b2d1751b329a9502f0fd6649679823f725b8c3

SHA512
702384f9d6d77da08fc8c49a5f65957c56e363e1ad37f9d0611092d248db1f79636a6cf336e55669e002194f589f584b5663b4d77e54fa95e18f84eb4864d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\es-419.pak

Filesize
124KB

MD5
f9958dd6ce0ce1acea070bbf317b1160

SHA1
0dbc4020e505a053cdbe6a0a9506829498a8a25c

SHA256
ea868929f537d48e846f86020762c59c77a0ec67765c3af22e08fcc853f94c2e

SHA512
35a6e5fdff6b4e3a076eea70b7c551f1d303b4db4e63aabbbde54b4fefe40d750a03440bed7851f12750661ff8b87c5ce3382b0c71d0e171f729a7a82f968cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\es.pak

Filesize
126KB

MD5
09e0feb85585bb4a220a3ab3f21adb9b

SHA1
e564afb37d5f5305585ad1081a26b34ebee73ccf

SHA256
cf7ea140dceac78042e0d35da45a4fe732eb04e1d2b138bee4cc2dc5e7e9a0fa

SHA512
8317bd2b4f509edabac1a74ec32bcfd54b14598799537d90178ec349cd71fe967d5c677403c85e305a6f2e94722c20a83e65c0bdb29a6265c5355683856f4ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\et.pak

Filesize
113KB

MD5
3ca246cd997a68bb4a6daa8b3b81908d

SHA1
842bf5f6bdd29ccccb24ea412497acdb37a5f805

SHA256
25c1e1306160779466d8c039ea296db65d12dcf21d2ad794a36ab62b1a7901fe

SHA512
32135a0c29bf666833292b557634d4510c185f711d7ad8625e981811ea082dca0d1714f481c9c8ce8b3acefd18469093d48fc05bc0160ffb87d1e2b90f4cba1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\fa.pak

Filesize
179KB

MD5
46412682e8d0743714fc28a520aeb35d

SHA1
dc6bd723efd460a56d205bc199e3be4c98698ba4

SHA256
9861d5260b98b384603ef02e97dac0295fd255e550b57fd427bbef24b1cd7b17

SHA512
c77c5344c6a7af4035f865aa7e3a3aaab39b11c4a3bdd94aa99f15dbc6ec7cf4b6057ff48fd55e2ff41041728fecf80dcd488578dc1db249ab1b7598fa438f14

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\fi.pak

Filesize
115KB

MD5
a3b5292c5e2e981dc4ce9504f638a542

SHA1
6cf480f3d7cb5df71bdd4089a1821f2eb2dacecc

SHA256
f4f2438a3810ccda4740442cdd964e43883cdeb820715cbd7be03cfa6b1e55ed

SHA512
6ed819896e2aa72d73bd2af731f7f714119fbe7d1fce5909d1a9d9ecb99c6369505e6d33f1f9ebadcb0da608f9aec365bc6cb5f6e22373d577cced7e317772c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\fil.pak

Filesize
129KB

MD5
7c3df3c13393e1b24e4e96f2b9082a6a

SHA1
caae1c99b589e14184e9f2c89f698a2558f4ec3c

SHA256
27196aee4a6248bee44ea2b5a3de90ccc2cd53f8ce1beeb796aa4d7e25bd43ae

SHA512
2d85d37d9560cd6ff460e32c3c569851ae28d794b5319ce74c010cad527c4004e54c993d5440bd22d6e51d86c4c4683f8db03c38abca4839a10e2efe46ae35e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\fr.pak

Filesize
135KB

MD5
a17cca5f1db7cedccda9c5a7784bebd0

SHA1
c5e0a0d24a14a535406886c00ad10d20638341b4

SHA256
e8da96855f7238a6ee3162b08d46e5ab84d98179dabf535060ef5fccdb36bc79

SHA512
0bb2217e44f1c8cd9e4cc2127454e1fd137c6fa101914bd230b9089d6317f599c9dfdddafe3d5cbc0fdc036e7b4f6e5cb528bddc572b5e26c8e0322f1a7d0b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\gu.pak

Filesize
252KB

MD5
10c1dc999bc7ab62e1f26b0497afa7bb

SHA1
68da1055b8acdf016b152a2f401322d3d76885b5

SHA256
b9690f3c550deb0827e409015abf3bcaab01c9acd33e96932e85ac84ff4c7831

SHA512
c10a956fdfab446b74f1dd2a169201f0b7ddc4ff1d7a635b9c81f07942ea0d34ea327e2e7f07e3a672ac85c8b8ce7a0e871d02946da4fb5e8e75713e56cbce61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\he.pak

Filesize
155KB

MD5
5db44f8dc63c819b0ae2a5458e36447f

SHA1
6b440ad4bdef6acd31ca8be5d085db26a49a209b

SHA256
bee5f133cc85f8ca280f9f41df6790aa65161fe8dac8dea7e26fc609240e84a1

SHA512
cd0d104597c5c926480443b5d1a16526ec0e48c3d6dca6233ec7cfa63f01f2f5674d9ac9a86a45b789a94fcb3b63aeaf92351bac2f4920a25dd8d4fcd1edce19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\hi.pak

Filesize
260KB

MD5
815dfb3eeb9a69919ecf2562b6d4ad34

SHA1
2d0fb4c2a19b7a991974783b51b13c7b3610b686

SHA256
a480e95a5cf338a90f7d077e4147f45696db9ad6e8cae1765ccc5ef05fb48505

SHA512
0e6c8374ed7f6f3b523c2dd5455b598ab0650da8ce3a8243a1a42c6327db9a694947a508a90edf95685c84120cc73964a16c7ec49835ea398dcc6186d08ef1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\hr.pak

Filesize
123KB

MD5
ebdf0ad52e9a0f8c8735614775ff5a94

SHA1
787feb9f703daa094814464b090aa5d36725e007

SHA256
b9c21e5187e8649157f5e49e014b8c285866ec839638344a31234b60a17e7d47

SHA512
e2853884687393fa2b0f8e4b27af5664c223fd5bb2862e5ef788f912771eb9d61e7ca1fc39f29ab679f49986b5a95b9da44727c69c99dfd3bb8ea2f4e974ada3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\hu.pak

Filesize
134KB

MD5
4b5fea4bd49738337ab10bb3f1e6bda4

SHA1
0f27220019e099b658a9c563995dc2b022fb1d68

SHA256
e526c9c9a8c4d27c432d3cc30766fbdec6c536b696a7ccb7e9376f0e55147b90

SHA512
4e271f8ca0028ff5b8a86e8610174739d2d2b7a267381562bbac3543d03f6895b3361c2f6fcfbcaea6f5aad1690e878ae0de5c905de12b213c2c5c396caafa66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\id.pak

Filesize
111KB

MD5
39378b548f712608903ee8aa25db212d

SHA1
7f5a3466a4c8609c6bab7ed3dbc9fed52cfe1e62

SHA256
426a302448ec17e313724b38bda9ad4d5c031da48a1ed3690b547b51a06229a2

SHA512
7d2d823445316f5a63df286af2f1e28b90b8e3a04aabc835020b17f690d95f7ba2d0261876495345876cf826fc57dd0a9577e79af7e609adb8c71b8b4ff03550

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\it.pak

Filesize
124KB

MD5
5b03bfc915b62aceb06b9c670fb77e33

SHA1
9c88ef98dea5a7d7be8571354ad3c033033a40b8

SHA256
1f9a38c852c05577aba397c388b35037eec6b9d90593800b5b57bac437b42684

SHA512
b22c4db0b56c136e9263a15bb2a31a9213ac20321b189cb0572bd1f0b0b9989a7e698d94750d9c5d01557f4b247abf9a8cff1940bab03fdb737a8276d96ed1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ja.pak

Filesize
148KB

MD5
640bb80728453be0104566caeeb8eb82

SHA1
362b46036c58421f4b0f9b2f714b21e244aeee44

SHA256
1bfb337c19c9d04bc53df2d2eca6b73c11df33b6fd07a6a3fce5427ef0f38cd4

SHA512
1bd764ec56166ac59fd2acb1ac81140bab2ba7f326c0bbdc9cd30ff6246fcdd98e49310b0528fb0d8a9256ac06ca3e145a3906a1815dbe395d989443650f81b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\kn.pak

Filesize
286KB

MD5
5a599f47d2e2ff1aaf4c8ccf8bafd10c

SHA1
32aa52f2e90348725eb619187272e9c5a7396bd9

SHA256
e55425a4ab6425f60a9389e5c19dcd5bf437816ae09a21cd53750819040143d2

SHA512
7ecb69b70d5782e22ef9047fbfa29c0778e894c5cd987d33d65e68616ba2a42a133abe16f2af70aee4fdcb34c7e8e3d3bc3c556c754a010132610628516ad456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ko.pak

Filesize
124KB

MD5
e2a95b73f9081efce223a180b7791c16

SHA1
addd6ac05707597b917ff9f7c3f7524be26df7ca

SHA256
afac9566a4e1fdb2be75faee46bf9182f81b85373d60cb583f1051b12d9719e9

SHA512
70eb91347c21f0e648e9fcf82ffbef5e3eeb6c0268f85fddc7ad4eaea2e22eadeab653476196240a75361505f40b0bdf8602b0f414faaa77354f0fe76ba4e09c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\lt.pak

Filesize
135KB

MD5
720c1b3c95e8613f2cd9e40f3d160ed6

SHA1
1ea62b51f1a2c80b92e3348de260032427a9c79f

SHA256
51027bfd566fa26cd561f9bbfd2b4a6d2e41e0ddd786b7338cecc43423b3e6d5

SHA512
32ad5243df09d642e058550d2ec58a8a8de00cc442da551c195958a95af7c82c4d2b63b27d474a065b0ced5680d3e005b2a36301d02fca09413e165089f47822

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\lv.pak

Filesize
134KB

MD5
fe9ff0063f35ba05d27cba720e2e69d5

SHA1
16a87c24f027eda9865df7090ac8023c7ae5b57b

SHA256
43bf3b7181b607d8769da6c2cf671e2a429439aee253dd774ab5bf5aa5fedde0

SHA512
794b1b87ca400798574be56cf8da9adef78f1f9f91dd42fb23e6355caf0455f8d982f2b3d9bc252673704375eb4ccf32d58ed1cbbadf8780590e5777ef41c035

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ml.pak

Filesize
302KB

MD5
a66617706e80fd5ff8ab6ba8dadafef8

SHA1
3718d0afa1bff72ad7164e41cb46981811583422

SHA256
51b2c600046abfa5774b85665d4c882daa3c90bad5559185f9335ff61f04fede

SHA512
4de6fabef9db34791d0d165b5064e68ffa19630482219e4c72e6dc0f9e9e56b1941297862bb2e267cc02c3d3327193a233f642b11cf74e1892270721a2d7dc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\mr.pak

Filesize
248KB

MD5
da44d4ade4c258629118dbf534f0c2cb

SHA1
d93756c9d2d2db7755b4b7d47042a451435cca7d

SHA256
fcf1d938863cbc4d4a1d62de0eacbfd17fee4a0f5a9fcc09627bc22a98e268c4

SHA512
827c291ccfea31799e2fd48ee35aa179006a7bb3420c0346b5f1291abb4560f84b952a2bae820ef129ad77719edb16873328e7f0d030f9e2970e0c620fe59328

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ms.pak

Filesize
115KB

MD5
63c4977a1e8f5ab37881705d084b47ca

SHA1
f716932d886b8a5441397dd6a8625cef88e85bcb

SHA256
8b18fef24ad28663e4dc5a5113a35111a78b848d70ea7fef4156ad75bdb4fea9

SHA512
3afd4f8db5a0880319b13009bcdc14892b8710b2ac91dea8641f1f632866ac564791f1d302e1208aeeb9977e613fefd6bc7c0a0fd5cb5d031a768362bc0d85ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\nb.pak

Filesize
114KB

MD5
23d5480b833f65f1f55cc3bbfbdf53c0

SHA1
639eff4556e4d6c879abf305176f23c014927042

SHA256
7ce821732e743c2da1f81527355226df11a21eec137940a034afeb34618c5daa

SHA512
b46b25a4dc294dab0f34e5ec733dfe7e1c73c6ce2817640a620e9a0c196292a7a4737f0f10806efba4d5831d5a2f0833925083983927b0d74cbc5c46e9c8b953

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\nl.pak

Filesize
118KB

MD5
6e404adeb945cb7952a8c4129e098759

SHA1
a870715beab03f3a53c74b5aac2f314b517184b3

SHA256
7531e450f725f7ac75ceaeceb09155786d367a4456f4e71e7523af9219748434

SHA512
30917740d923ca25fb9f3c32bca100d58388f5c6d3516a29f3a39d1ca8ab3e4058b271224c8b9554479d91718cca3dc1c9cb08b38b19ccc36a0d57ed0146ab70

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\pl.pak

Filesize
129KB

MD5
def25f809c246d15d8a2f41a78b504c9

SHA1
4462b50e5613b1519987584d974fa0efd1812ced

SHA256
165005f81f071a315d0c4183fb3bc899e464c4cbf2dc450ffa09ae6bb5d517d2

SHA512
e6f17d5426ba98348209a51632db0cfe19287baf3752948bd76acb77b7eca51aae905adf7c316b17cc44856231d034f044cc056b0e0f1ce3b4999dea29597cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\pt-BR.pak

Filesize
123KB

MD5
7b7bf21b01ccfb27af8cd37d738f1106

SHA1
da1db09ee88c005610ed08dcde1b2cd73bcebd84

SHA256
1feb01da1f443fee8ff01c3b585d8f0ebe6a5e242483cf6f0f93088e76913e76

SHA512
ea0bf1357616fd33b41c7189eafd2948324bbfdedb043974dcd0f78693fe868a4d37ee2c0e979d9795cad63cbe70fba0794641beece737886cf92bc29622e464

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\pt-PT.pak

Filesize
123KB

MD5
b7598cb8f05f465909ddb0045d60162e

SHA1
b794c944dd5287e550a3e46bc9a0584d3d753eb1

SHA256
c338f6de946cca52c457d236037cf1c9f13b6c73796b713f390524f321b401d6

SHA512
a53e9d6af760c4aebd418de134ba23ebc27076b02082e9eb1afb1bb7ec93a45ea22a4961c49023d7ca8b2d3aa99462ec35180797982a481ae823ac19b4b96f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ro.pak

Filesize
126KB

MD5
1ab0cbe10cb7c3d5beadc7b04a881885

SHA1
eca1fe3842b4a1b070a0f9ba1a27fd3e6284ba80

SHA256
9a80b326b712debc0d6e9639b45352fed1c4a49ec37490b49b8506c636fd2947

SHA512
581e42422db7ead773990036ce49a5d2589f3af610604582a4820dcee1c37d2923fbace738a42cb8b87407915e1693bbca6a2234a0716c7c8d875ca30915289b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ru.pak

Filesize
201KB

MD5
d269143626296c69906523810139e9af

SHA1
43abe13a4837892644774bf06eb89cafec49ac95

SHA256
b1bd2d1cc678784ab73a691d4a3dc876be78eee0a30661ac2666a9b8ab864ecf

SHA512
76b0cc1841dba7d4b4175b0c10d6c36c7f3e8ea4ad0b4e4c091391e2754913cb6c02f0285b73372d604a395b23995998090a0c68b607b4106226b7ac67ceff23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\sk.pak

Filesize
131KB

MD5
3ee3730ba0f6894f2651e4e1be37a214

SHA1
3a3adb77fcb6d0514a221e6671d815a1cb7a2c35

SHA256
23c8d9722e0a2e22fbc8ae1bebb9cff456fe026c986a211565fa9398376e64af

SHA512
000928407693007645230ab593a6055e6005e6c2cb362057ce8a1915ad96030a03b134ee20e3197daac9920c69df188867d3c5a603a3e36c2eccb0bdcd549206

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\sl.pak

Filesize
124KB

MD5
c20064c5c0dae644ce4ccc0a2234c128

SHA1
a50411c1431ae1f4fac74a34f1716809a0623380

SHA256
576891a9a61b9cd50024e507e93d32476332977db8e29ef3d46427015d4d26e6

SHA512
04f979cfc813c6b1d3a5d9b3b306c415529a1fb72e415e2742ee25ccebf04bbe3abca91bd66aa3633a97a1383f3c4b915319b8d0b25c0ef6eb8c2e08312dc01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\sr.pak

Filesize
190KB

MD5
0cf9aea120b76672d2b5e30e928459c5

SHA1
0219aaa5d84847fe86762baa82b7b8b301239c9d

SHA256
b6aeb180462d8f312762a419b45c910929e2322d45bbf2b84b0871ccf7838945

SHA512
e79a0800571ab7b64602db4941b689231edb20d65a89272b7dcae53426b7811791df8f6ef174c83680a6adf931efc3d47f133b971254c139e8b04953b8a10979

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\sv.pak

Filesize
114KB

MD5
007d56b78104f7e245f7c84f07949f25

SHA1
8e3104a8c26f8418f44e19640d9babcd68a640c1

SHA256
e6c9329d7184190a0282f6440dcad5531f9656514a37b7dcb5a510ef17f3793c

SHA512
30c492d48aff33af8a0290cbe29864ff5c7d46dc50f5c4c6d5c96e6aa273926840b28b78958070e1534038e66c0142ab65153d32d28b56fb5dca28844370a946

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\sw.pak

Filesize
118KB

MD5
89c5dce32ff87d5fb2b8e815f7e4cbab

SHA1
ca3138ea6103a5ba39e35c53e980b44c9889d386

SHA256
ca8d57f632880f7b736ef7f8c5f35ddc867e50919b1f7d835bae76f823ebed13

SHA512
9e3ded0e33f9441f31e95317ac6a7a140ee5c63bea8b1bf8c03952804fb6783e61e7971d5cbe1c698d3c4067233b78bf37099054fcfe38b091829f5435e6d435

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\ta.pak

Filesize
300KB

MD5
3dcd0523ccad674f2e93de57ad0082fe

SHA1
fd4a28ee288a1f33ee7260ae80df93aae9718039

SHA256
72ef4527f01018c90c583e48f37d20bfa684012bc00cb9ab5ffa3e222b9c7f3a

SHA512
2ec95b89051b019e98e6a1852e5e89e1c985a10998af1cb2603e5766698a2880355d8e6b959e60e9edb84354e99d0286708027c39a8add816c172ad1efe35b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\te.pak

Filesize
279KB

MD5
1eccb7be373fc3144ada2df9e493cc07

SHA1
eef3e05afdf910671a046cf90291c17731bdb378

SHA256
bd0a936ab62ab6ab172a192b7c082b824706f6b3d88580a6b6be32809354fc2a

SHA512
ea30d14fb7c2ad54263e12eb8469e6b058afb30448900b55d944aa87e266d735f2a04d2f29303087f2d13f379483d681285182e6ad2bb25bf36e311828e2a08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\th.pak

Filesize
235KB

MD5
1a66feba0d44231b935d83a7f36a09a0

SHA1
3e674234b10350ebec218c904a9c90f3edd29711

SHA256
11fd04f3b33d09041d646d34e61fa15b96c12dbc62e229b64306356de6155cac

SHA512
b7617094a6d27670c0720dc5dade4a866ecdd68c45c1b9e6dfe1c3074dd1957bd7459210d111ef33727122666b24c2449cce9f3e903aae59dcbe438b38c8a021

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\tr.pak

Filesize
121KB

MD5
2bcae092530d06fba9b23492ac4a1d6a

SHA1
4114af7364210a4bcd10099911083de2abc25d40

SHA256
65105386d6b52445fdc7660648259b43a04849a05035d749858d9f64d4209836

SHA512
e87778246b98d87f2f29e2abb02290b829cdcb753fd9b184fec61b0523452e262527432b73a11eba86d547ffce2ce00b4180ae8367419e2174b825ed290345b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\uk.pak

Filesize
204KB

MD5
ba2462d8b3b975bb265bcce6a3410cf6

SHA1
3caba82b3e14350a33711db68d98e6d211ac9fe5

SHA256
1dc63c538f6b96cf4e70284c078a6e18f58f599db2a2ec594da23b244944c9cc

SHA512
a46441e2c97032928dfc19b178cd3261887b7076917a4fe829083151c8298703c3921001cd62c630b35504444f069973605b487c954623ce16682491fccb7d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\vi.pak

Filesize
144KB

MD5
806b7d282e74565b95264ebbe6794d48

SHA1
3aabe2d802283fb9b3ef43932c1b7638ef6a1053

SHA256
7b4bf97b78a07422359b709ea17d1d6aa038e12ec420cd0fc7dce4b313fe4af7

SHA512
7380b7a2b239932d1167f194f81a1c867983fe318a1e48d246470de0c94837edd6c0a641e06f888e36ff5041fc2a69d19cf1a46bef816d07fd3ecda42b84e524

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\zh-CN.pak

Filesize
105KB

MD5
c82a124cc6e87ad403a67007b9c1fdb0

SHA1
1d4f1c0a3cda7d4a75a0f4035bc6d2718102f09c

SHA256
f597245963ca7b42b2a7e5e80af5258972002fd4bcd3a21c875e4051df3eb1a9

SHA512
5e45df31658039144316299879b4f1de7eb157fb830d08e8d93d3ccc2e033b1f8e2f59d29e11785ac8346988d5ba2afc373c01bc4a58ba3cc4439d9aff1ada87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\locales\zh-TW.pak

Filesize
104KB

MD5
ad19e8ac7f2b5e5f67b9f5671299d19e

SHA1
4a6936a4971c2b9a414f40de3eb5dafe1b5b3e52

SHA256
e30d22153e0860246c8c37855a385471ad1e74e1eadf56476a1ea980f9204d86

SHA512
4f283deaad6ef0327baf7cdfef063293d27c1746431261553a6c7925832fe77c8017c6d11f36c5ec657ecd3b563099c9e35bd2cbe52c12ee734f4bef9bffe077

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\resources.pak

Filesize
4.8MB

MD5
2db0729cb0a452b13400e0ad97a46a8e

SHA1
2aaaa7e0e932e7b46958214cce81d60099cfc2a0

SHA256
af41c2d4484ee3b86b63bde75f150bf67f78a6257d91b397b6b15d47b041e177

SHA512
967bcac22315ecbe76c5a1cec4439523a92710791ea6112aedeb2d294419714e7aab5526f868898c6c2cb83886dc98c694dddd314766c2ae373f55f3529a65fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\resources\app.asar

Filesize
68.0MB

MD5
06deba6b031559fab9f535d7cbb15716

SHA1
4b1c6d05b68da3ca507c35080aa258fff5ef4dab

SHA256
f34c8afd222c7feb3c0c2adb1281a3ad88c3e151f99e2b3805d6ee318a4f1bd7

SHA512
869b571d9eee1225e164c01e26ff229056240147cf630d721c6d2ed265e2700c4385636d0b958546d8fa6262df4f573a50ce6fb5d9743e0152a53245c170c240

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest

Filesize
350B

MD5
8951565428aa6644f1505edb592ab38f

SHA1
9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

SHA256
8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

SHA512
7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js

Filesize
3KB

MD5
d226502c9bf2ae0a7f029bd7930be88e

SHA1
6be773fb30c7693b338f7c911b253e4f430c2f9b

SHA256
77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f

SHA512
93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat

Filesize
13KB

MD5
da0f40d84d72ae3e9324ad9a040a2e58

SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\snapshot_blob.bin

Filesize
342KB

MD5
19f1e25cc7c427dbfb519ce6dc2c7e64

SHA1
5578aa048412482650bb51b04ccbf038155f5c8b

SHA256
b6531c8ff3a288d00e4625cfc5019ccdac9cb8a53e723792616aace3b27f90c3

SHA512
ef07c82a8a3f36bc8492d0c0a964ee57c3bae3188c7c67eb555b9d117739b5a09e44183dbf9f2cf17ac386d7d777b62b534b2f55edec977c75ec3d6b5b535620

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\swiftshader\libEGL.dll

Filesize
450KB

MD5
2ffc36c5555a36a4f26c1aa7a8108b4a

SHA1
2ec38b17a0e9d5b0a4c397921aa4430607d32edc

SHA256
f8b8b96cc384171268cbd543d9486a97b2f2066d45ac118421ff974baf18d2e5

SHA512
0df87d336e223ade77eecaee88d8af2832f1cec3b5681699646e0be933b3f0acdb3765492e9d8fd713453dea2a7fd38d46c201c96313a06a484f23a78a716cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\swiftshader\libGLESv2.dll

Filesize
3.0MB

MD5
41d3387761bbb79d4820e8d242561027

SHA1
27dfda8ce933af12578fb64f3171f40f56bace55

SHA256
ed005ae1d388e0256e9ae304933980897ec2cfa957ed5babab6ae2a5dcf5c5f5

SHA512
cc396d0c2a94c31b8a42697f456f74e8ede1ad1fbc7eb1e4983544166041ff878048f60af9b1525320770ee477c63d6c466746c2c33fd30bc2d7ec903f8af944

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\v8_context_snapshot.bin

Filesize
656KB

MD5
c384ae622a7a6c7ec328678af12922c2

SHA1
25165dcaf78d3d29a16e4f979370e0b009ede240

SHA256
977a027c50bd79e93ec015fbebaccfaaa8885b88c76f7e5a2c33337d6d5173c3

SHA512
d0571f5e18dcf14a591a76243d52094bb843b0779630f31cbb66fd738c1c35d10bb7ef751eb01a953305ee19f2777f4d3ca6f9b132199b2af357c0b03185d9a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\vk_swiftshader.dll

Filesize
4.4MB

MD5
37bba2c66e2364a5b3e6666864f3b604

SHA1
f2ecffd48760482ba055aa50cd78c5ac02d09ba2

SHA256
23e6927733549be11d506b862cc7148b7b08b50b4387837db522ec9380babc46

SHA512
6e7835fce0e988c997049796125b4f2ef83cb9c2e326edeb54d4bad77fa31bf4b4227aeb1db445d3ee21e6cb959d65310a1bbda2d14e567d4123cf6544a947ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\7z-out\vulkan-1.dll

Filesize
819KB

MD5
ad4a5dcf631afd553b4fed8a269c7897

SHA1
f1bded0b28ee8aed4a52a6d19d871eba4828e0f2

SHA256
3141825bfa3a8cecf8b59767e8b6ac41c20685932d6000b9c6cd0e40ddca12db

SHA512
8e01379201f2a907cff7f32dfbac6b1eb8ee014312755884b35e4065477d8a8069e3188086d7cced11d437b461211bca6abb6e582e98473883cf35faad41eae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Filesize
12KB

MD5
9ee521260bcf8abe95005ba3fd0d26f7

SHA1
0f16c87708de16fe3be824aecf35bc0706b963ef

SHA256
4ebd1ed72b6fd42fe2196b5e683392ecaad1de5a541ed58fc69557f4ca092dfb

SHA512
bec1842dcc7359ad9a24dc617d29f05a56a70e8a1dc38ec8e90cb94f8c72a6ecebaa2e1aa41be521fb8185e8b4f536df68cfca43b3b32de1a26c21a0360e277c

Download Submit
C:\Users\Admin\AppData\Roaming\UnityLibraryLinker\Network\Network Persistent State

Filesize
393B

MD5
8110d7ebf3ccd4427a8a13aff51aa2a5

SHA1
fba92243cc1f5bb4bb774c72eeb3db6cdfd85b37

SHA256
85fa75d33eafe0a2d373077d063253d99e40265587e39dfdeebf4bd8a4b8cc4d

SHA512
6a7df3a3c8a22518f9f5b3a8b835cb3b2f482432a3c63215e5b68917ab342995d7cbbc7bb3c810a15e3a0f1a60fd6609fad2072b3e284287604d986f5164aa3f

Download Submit
C:\Users\Admin\AppData\Roaming\UnityLibraryLinker\Network\Network Persistent State~RFe58ca50.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC197D18E8AF8749E59151D2DFF56E1728.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
\Users\Admin\AppData\Local\Temp\139d3df7-cb71-4e0f-863e-0f5d87441e38.tmp.node

Filesize
652KB

MD5
a2a44119006e8e5e808e529577f4c088

SHA1
51e66c2fe08eb1b06f436689b3d5358f66639543

SHA256
c89398585a34d9f3c9295c8f1ee0121fa40fd155f7fd91814e89f18d437f7a10

SHA512
a106835543b9417e0ef4d8e74b7a89f12fabfded7e2731870ac297d8340825b0272c5917e6561469133cb7b2db725a067ab7606d68f30bae5bfeb02cffc16c61

Download Submit
\Users\Admin\AppData\Local\Temp\25e7d52f-7293-41ff-bfd7-949f5217d582.tmp.node

Filesize
2.7MB

MD5
08b28072c6d59fdf06a808182efed01f

SHA1
35253af00af3308a64cff1eda104fd7227abb2f4

SHA256
7c999c84852b1f46a48f75b130fea445280d7032a56359dffecf36730366abc5

SHA512
f2592ade5053b674dbe4191c7001748a801dca3b19e97e19b440a3e944011c87926b0ef21c87e98b48e038889a32e01c1d74949124be3144834e2f06d9781198

Download Submit
\Users\Admin\AppData\Local\Temp\e00d6e78-eee8-4a0b-8cd2-6ed5f8b6cbf3.tmp.node

Filesize
163KB

MD5
b0e113443ddc1ee234acbf0eb0e6f8a0

SHA1
84cc562b82570ec05df6dbbfc8f29fbb16ec68c7

SHA256
8d6f5cab1d6a99ac49772080c6f383f33a9bb983e0f8d02d0f3de4b2bdd26215

SHA512
306e89ec66fdf8b0de19d5bcda01f69809d83f464a9c21fda4b470e81ad3b722aa6cb6086fb4c2af59504fe4332c1f9efff27168598cc00be0f28fed45dde8ee

Download Submit
\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsc7EA7.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/192-850-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/192-755-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/212-768-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/212-816-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/212-819-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/432-782-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/432-785-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/980-977-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/980-930-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/980-978-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/1212-964-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/1212-888-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/1432-969-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-861-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-939-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-792-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-789-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2284-893-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2284-890-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-974-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-903-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2448-1003-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2740-599-0x00007FFED7D80000-0x00007FFED7D81000-memory.dmp

Filesize
4KB

Download
memory/2784-908-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2784-980-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-874-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-873-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3300-912-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3300-952-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3300-773-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3300-777-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3300-949-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3316-1008-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3316-1011-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3328-826-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3328-914-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3452-809-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3452-813-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3604-984-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3860-1002-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3860-923-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3988-723-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/3988-717-0x00000000007C0000-0x00000000007CA000-memory.dmp

Filesize
40KB

Download
memory/3988-807-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4184-735-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4184-808-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4408-739-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4408-831-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4408-834-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4408-742-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4424-963-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4424-960-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4496-747-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4496-750-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4496-997-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4496-994-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4552-998-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4552-918-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4760-1017-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/4760-945-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/5100-990-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/5100-987-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/5116-849-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/5116-802-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download
memory/5116-799-0x00007FFEB5D90000-0x00007FFEB677C000-memory.dmp

Filesize
9.9MB

Download