0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149

Analysis

max time kernel
8s
max time network
144s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe
Size

69.7MB
MD5

3b75fbd96388d92a64dc14d9aeea8235
SHA1

5e8ac216d79c651babaff716638433e0ec1e3b36
SHA256

0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149
SHA512

9294154deae66eb89c03dc4d5cd018025eaa3b943f4c193edd8216ae13acdf549ea0a5687da1ee39e51c3b8b8dde76f94b37da1186ce05bb5b359f5f2ff6f79e
SSDEEP

1572864:U45L3pDgGUo6tl3M4nqp9rLqDND6+wO+OfbQHe2G2hCN/h:7Dgx3Zq/rLfRO+HeXKCNh

Score

9^/10

evasion

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000500000001c840-565.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

EpsilonFruit.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	EpsilonFruit.exe

Executes dropped EXE 1 IoCs

Processes:

EpsilonFruit.exe

pid	Process
1836	EpsilonFruit.exe

Loads dropped DLL 7 IoCs

Processes:

0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exeEpsilonFruit.exe

pid	Process
1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe
1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe
1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe
1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe
1836	EpsilonFruit.exe
1836	EpsilonFruit.exe
1836	EpsilonFruit.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
5	ipinfo.io
6	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

Processes:

WMIC.exe

pid	Process
2516	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exe

pid	Process
2560	tasklist.exe
1752	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe

description	pid	Process
Token: SeSecurityPrivilege	1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe

description	pid	Process	procid_target
PID 1664 wrote to memory of 1836	1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe	28
PID 1664 wrote to memory of 1836	1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe	28
PID 1664 wrote to memory of 1836	1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe	28
PID 1664 wrote to memory of 1836	1664	0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe	28

C:\Users\Admin\AppData\Local\Temp\0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe
"C:\Users\Admin\AppData\Local\Temp\0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
  C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
  2⤵
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
    3⤵
    PID:2240
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic CsProduct Get UUID
      4⤵
      PID:2204
- - C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
    "C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonFruit" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1076 --field-trial-handle=1208,4696607400159602468,14444531090351842872,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:2220
- - C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
    "C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonFruit" --mojo-platform-channel-handle=1276 --field-trial-handle=1208,4696607400159602468,14444531090351842872,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
    "C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonFruit" --app-path="C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1424 --field-trial-handle=1208,4696607400159602468,14444531090351842872,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    PID:924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:2412
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
      4⤵
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
    3⤵
    PID:2428
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
      4⤵
      PID:912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
    3⤵
    PID:2720
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
      4⤵
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
    3⤵
    PID:1508
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
    3⤵
    PID:2436
  - - C:\Windows\system32\cmd.exe
      cmd /c chcp 65001
      4⤵
      PID:2332
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2876
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2880
- - C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
    "C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonFruit" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 --field-trial-handle=1208,4696607400159602468,14444531090351842872,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
    "C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonFruit" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1976 --field-trial-handle=1208,4696607400159602468,14444531090351842872,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ovzqq1.bt8gs.jpg" "
    3⤵
    PID:1540
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:1636
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4683.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCC679604352FB42D8B5DAC33DB7A1D52B.TMP"
        5⤵
        
        PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ovzqq1.bt8gs.jpg"
      4⤵
      PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"
    3⤵
    PID:2204
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f
      4⤵
      PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5571e8.bndtu.jpg" "
    3⤵
    PID:2520
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:2792
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4684.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC9A23AE696D3840CD89D4B4C35C83CEFE.TMP"
        5⤵
        
        PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5571e8.bndtu.jpg"
      4⤵
      PID:1820
- - C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe
    "C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonFruit" --mojo-platform-channel-handle=1032 --field-trial-handle=1208,4696607400159602468,14444531090351842872,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ewn6d5.ifj1.jpg" "
    3⤵
    PID:2492
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:2876
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4685.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC177C6054BD8B448BB08D1EED3B1263D9.TMP"
        5⤵
        
        PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ewn6d5.ifj1.jpg"
      4⤵
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-kbdwpm.ktuo.jpg" "
    3⤵
    PID:2332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
      4⤵
      PID:904
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4682.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC75B23E5B3C8248448975F3F5B8FCAB0.TMP"
        5⤵
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-kbdwpm.ktuo.jpg"
      4⤵
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jln5v1.a0d6.jpg" "
    3⤵
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jln5v1.a0d6.jpg"
      4⤵
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16nzh2q.8mob.jpg" "
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16nzh2q.8mob.jpg"
      4⤵
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-eassed.degfm.jpg" "
    3⤵
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-eassed.degfm.jpg"
      4⤵
      PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-b60k7.n2ias.jpg" "
    3⤵
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-b60k7.n2ias.jpg"
      4⤵
      PID:2544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dj0mpx.o9y3v.jpg" "
    3⤵
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dj0mpx.o9y3v.jpg"
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-pt3nx6.pyk7o.jpg" "
    3⤵
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-pt3nx6.pyk7o.jpg"
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6nh7f.tarzec.jpg" "
    3⤵
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6nh7f.tarzec.jpg"
      4⤵
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jdhg6t.gp0b.jpg" "
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jdhg6t.gp0b.jpg"
      4⤵
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ogrfi7.5oxir.jpg" "
    3⤵
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ogrfi7.5oxir.jpg"
      4⤵
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-d0w1ur.maqwm.jpg" "
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-d0w1ur.maqwm.jpg"
      4⤵
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ufuzhz.tcrb.jpg" "
    3⤵
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ufuzhz.tcrb.jpg"
      4⤵
      PID:1248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-cysx5o.zqwsb.jpg" "
    3⤵
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-cysx5o.zqwsb.jpg"
      4⤵
      PID:808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m2te79.qtzy.jpg" "
    3⤵
    PID:412
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m2te79.qtzy.jpg"
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-r4vn7h.ax94f.jpg" "
    3⤵
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-r4vn7h.ax94f.jpg"
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1061z6u.k2wy.jpg" "
    3⤵
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1061z6u.k2wy.jpg"
      4⤵
      PID:284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-10cvtfm.8tga.jpg" "
    3⤵
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-10cvtfm.8tga.jpg"
      4⤵
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ccocwv.4qu5.jpg" "
    3⤵
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ccocwv.4qu5.jpg"
      4⤵
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-cxipe0.mk3jv.jpg" "
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-cxipe0.mk3jv.jpg"
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1p037hz.0p7qg.jpg" "
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1p037hz.0p7qg.jpg"
      4⤵
      PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15rmwug.knco.jpg" "
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15rmwug.knco.jpg"
      4⤵
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mc99of.4pch.jpg" "
    3⤵
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mc99of.4pch.jpg"
      4⤵
      PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jqabyx.4ss9.jpg" "
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jqabyx.4ss9.jpg"
      4⤵
      PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-wutdg.nirbc.jpg" "
    3⤵
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-wutdg.nirbc.jpg"
      4⤵
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-f2h4os.qvdjn.jpg" "
    3⤵
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-f2h4os.qvdjn.jpg"
      4⤵
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1dd8i6i.tp86.jpg" "
    3⤵
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1dd8i6i.tp86.jpg"
      4⤵
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-19jrsy0.2vty.jpg" "
    3⤵
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-19jrsy0.2vty.jpg"
      4⤵
      PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1f2e1n2.qzm6.jpg" "
    3⤵
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1f2e1n2.qzm6.jpg"
      4⤵
      PID:284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1241zxu.y1hl.jpg" "
    3⤵
    PID:580
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1241zxu.y1hl.jpg"
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3munw9.lzg9p.jpg" "
    3⤵
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3munw9.lzg9p.jpg"
      4⤵
      PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1nplvaf.vxm4.jpg" "
    3⤵
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1nplvaf.vxm4.jpg"
      4⤵
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-26cu64.x5c3j.jpg" "
    3⤵
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-26cu64.x5c3j.jpg"
      4⤵
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qzs8kk.ak31.jpg" "
    3⤵
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qzs8kk.ak31.jpg"
      4⤵
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m0a0z4.0fp3.jpg" "
    3⤵
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m0a0z4.0fp3.jpg"
      4⤵
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1s83z5b.9ajrf.jpg" "
    3⤵
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1s83z5b.9ajrf.jpg"
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-d23ktv.xxx4j.jpg" "
    3⤵
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-d23ktv.xxx4j.jpg"
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1yzseb4.fc5r.jpg" "
    3⤵
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1yzseb4.fc5r.jpg"
      4⤵
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-j8vnl8.5lfs.jpg" "
    3⤵
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-j8vnl8.5lfs.jpg"
      4⤵
      PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-4dxmjv.lh9xj.jpg" "
    3⤵
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-4dxmjv.lh9xj.jpg"
      4⤵
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-pcn1no.mfzm.jpg" "
    3⤵
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-pcn1no.mfzm.jpg"
      4⤵
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1bkxkw0.v6ym.jpg" "
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1bkxkw0.v6ym.jpg"
      4⤵
      PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qcosbi.oz6c.jpg" "
    3⤵
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qcosbi.oz6c.jpg"
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17759zx.f1pp.jpg" "
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17759zx.f1pp.jpg"
      4⤵
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x2ng4l.yc7pf.jpg" "
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x2ng4l.yc7pf.jpg"
      4⤵
      PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16lf2ej.004b.jpg" "
    3⤵
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16lf2ej.004b.jpg"
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-npypo8.m3z9.jpg" "
    3⤵
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-npypo8.m3z9.jpg"
      4⤵
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1k6cnn.rlrn1.jpg" "
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1k6cnn.rlrn1.jpg"
      4⤵
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cczj7i.buvy.jpg" "
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cczj7i.buvy.jpg"
      4⤵
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ibgt04.mt0hp.jpg" "
    3⤵
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ibgt04.mt0hp.jpg"
      4⤵
      PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m5s6f0.nkrw.jpg" "
    3⤵
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m5s6f0.nkrw.jpg"
      4⤵
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-xbj8pk.458td.jpg" "
    3⤵
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-xbj8pk.458td.jpg"
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6bhqwv.luffy.jpg" "
    3⤵
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6bhqwv.luffy.jpg"
      4⤵
      PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14xvf97.q7dgk.jpg" "
    3⤵
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14xvf97.q7dgk.jpg"
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hveq33.rz2a.jpg" "
    3⤵
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hveq33.rz2a.jpg"
      4⤵
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1qlteg1.25bi.jpg" "
    3⤵
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1qlteg1.25bi.jpg"
      4⤵
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1n39hin.z8mo.jpg" "
    3⤵
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1n39hin.z8mo.jpg"
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-s44vxd.1rb3r.jpg" "
    3⤵
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-s44vxd.1rb3r.jpg"
      4⤵
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11d6x67.48tj.jpg" "
    3⤵
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11d6x67.48tj.jpg"
      4⤵
      PID:1096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-n7q4bl.nbisr.jpg" "
    3⤵
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-n7q4bl.nbisr.jpg"
      4⤵
      PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-g12dwa.ja1p.jpg" "
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-g12dwa.ja1p.jpg"
      4⤵
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15jwl4w.cs8c.jpg" "
    3⤵
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15jwl4w.cs8c.jpg"
      4⤵
      PID:1468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-9q10yn.3s98.jpg" "
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-9q10yn.3s98.jpg"
      4⤵
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ujej03.23o3f.jpg" "
    3⤵
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ujej03.23o3f.jpg"
      4⤵
      PID:600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-19fafa7.whk9.jpg" "
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-19fafa7.whk9.jpg"
      4⤵
      PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11eb446.dwmol.jpg" "
    3⤵
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11eb446.dwmol.jpg"
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gs56pj.j7gm.jpg" "
    3⤵
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gs56pj.j7gm.jpg"
      4⤵
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1e069sq.kz6g.jpg" "
    3⤵
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1e069sq.kz6g.jpg"
      4⤵
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14dnrco.1hso.jpg" "
    3⤵
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14dnrco.1hso.jpg"
      4⤵
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-vpuldc.vd6yl.jpg" "
    3⤵
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-vpuldc.vd6yl.jpg"
      4⤵
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jjkm6w.y3wh.jpg" "
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jjkm6w.y3wh.jpg"
      4⤵
      PID:868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3usprk.7uhtq.jpg" "
    3⤵
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3usprk.7uhtq.jpg"
      4⤵
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-sj3pr.4oz1e.jpg" "
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-sj3pr.4oz1e.jpg"
      4⤵
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-op85gt.guuya.jpg" "
    3⤵
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-op85gt.guuya.jpg"
      4⤵
      PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1uv8ml3.90uo.jpg" "
    3⤵
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1uv8ml3.90uo.jpg"
      4⤵
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1oj7g88.n1dg.jpg" "
    3⤵
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1oj7g88.n1dg.jpg"
      4⤵
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mn5z3o.43hl.jpg" "
    3⤵
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mn5z3o.43hl.jpg"
      4⤵
      PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mgmies.178gt.jpg" "
    3⤵
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mgmies.178gt.jpg"
      4⤵
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-q063zx.6nvu.jpg" "
    3⤵
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-q063zx.6nvu.jpg"
      4⤵
      PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6qncq3.28tok.jpg" "
    3⤵
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6qncq3.28tok.jpg"
      4⤵
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1h16vw6.mxlu.jpg" "
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1h16vw6.mxlu.jpg"
      4⤵
      PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-h04hf9.99gx.jpg" "
    3⤵
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-h04hf9.99gx.jpg"
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ca67o9.tmo4.jpg" "
    3⤵
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ca67o9.tmo4.jpg"
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gxt3z0.08vyl.jpg" "
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gxt3z0.08vyl.jpg"
      4⤵
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-7ls17c.90q49.jpg" "
    3⤵
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-7ls17c.90q49.jpg"
      4⤵
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16xkhhb.6r19.jpg" "
    3⤵
    PID:472
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16xkhhb.6r19.jpg"
      4⤵
      PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cdie00.31zm.jpg" "
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cdie00.31zm.jpg"
      4⤵
      PID:296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-f6ekn9.n12yb.jpg" "
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-f6ekn9.n12yb.jpg"
      4⤵
      PID:600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-101vpkj.1mrw.jpg" "
    3⤵
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-101vpkj.1mrw.jpg"
      4⤵
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-2e8yo0.zmi4a.jpg" "
    3⤵
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-2e8yo0.zmi4a.jpg"
      4⤵
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-lkk6tm.wd0tc.jpg" "
    3⤵
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-lkk6tm.wd0tc.jpg"
      4⤵
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-f3p3vr.w6jj.jpg" "
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-f3p3vr.w6jj.jpg"
      4⤵
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-l1neuw.gbb.jpg" "
    3⤵
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-l1neuw.gbb.jpg"
      4⤵
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ch7ryi.l2gso.jpg" "
    3⤵
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ch7ryi.l2gso.jpg"
      4⤵
      PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-li040l.qd2t.jpg" "
    3⤵
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-li040l.qd2t.jpg"
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14nj6cn.07hc.jpg" "
    3⤵
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14nj6cn.07hc.jpg"
      4⤵
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1oo232j.qqd4.jpg" "
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1oo232j.qqd4.jpg"
      4⤵
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-e5llvb.b7v0q.jpg" "
    3⤵
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-e5llvb.b7v0q.jpg"
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13jahn4.qjwd.jpg" "
    3⤵
    PID:472
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13jahn4.qjwd.jpg"
      4⤵
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1dltr8g.dxrpg.jpg" "
    3⤵
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1dltr8g.dxrpg.jpg"
      4⤵
      PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5er8m8.l1r2u.jpg" "
    3⤵
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5er8m8.l1r2u.jpg"
      4⤵
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mimhuq.4ntz.jpg" "
    3⤵
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mimhuq.4ntz.jpg"
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hs8vt4.4fueg.jpg" "
    3⤵
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hs8vt4.4fueg.jpg"
      4⤵
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ldzpa4.swuz.jpg" "
    3⤵
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ldzpa4.swuz.jpg"
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1vd4wzh.2b55j.jpg" "
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1vd4wzh.2b55j.jpg"
      4⤵
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-xczdzk.s6a7f.jpg" "
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-xczdzk.s6a7f.jpg"
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15h437k.2hy.jpg" "
    3⤵
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15h437k.2hy.jpg"
      4⤵
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1an6i6j.pjv.jpg" "
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1an6i6j.pjv.jpg"
      4⤵
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-2k3gix.p17pc.jpg" "
    3⤵
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-2k3gix.p17pc.jpg"
      4⤵
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-w0y8it.mayai.jpg" "
    3⤵
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-w0y8it.mayai.jpg"
      4⤵
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-r5ryuw.fq5sd.jpg" "
    3⤵
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-r5ryuw.fq5sd.jpg"
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mcoxhe.ik7z.jpg" "
    3⤵
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mcoxhe.ik7z.jpg"
      4⤵
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1x4keja.40v4k.jpg" "
    3⤵
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1x4keja.40v4k.jpg"
      4⤵
      PID:600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1iseoyl.7ux.jpg" "
    3⤵
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1iseoyl.7ux.jpg"
      4⤵
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17x6jwl.8kqi.jpg" "
    3⤵
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17x6jwl.8kqi.jpg"
      4⤵
      PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dgih20.h5dv9.jpg" "
    3⤵
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dgih20.h5dv9.jpg"
      4⤵
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hj1qe5.ap2kh.jpg" "
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hj1qe5.ap2kh.jpg"
      4⤵
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13vge80.p0rlh.jpg" "
    3⤵
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13vge80.p0rlh.jpg"
      4⤵
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3lo5fs.9oq45.jpg" "
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3lo5fs.9oq45.jpg"
      4⤵
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ect17m.wdfjk.jpg" "
    3⤵
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ect17m.wdfjk.jpg"
      4⤵
      PID:912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-2i7xbh.m1e65.jpg" "
    3⤵
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-2i7xbh.m1e65.jpg"
      4⤵
      PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3mzl9s.b9ssd.jpg" "
    3⤵
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-3mzl9s.b9ssd.jpg"
      4⤵
      PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1kewhb3.jdqk.jpg" "
    3⤵
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1kewhb3.jdqk.jpg"
      4⤵
      PID:668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-4p5msu.a4e4n.jpg" "
    3⤵
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-4p5msu.a4e4n.jpg"
      4⤵
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1tbk6ea.nwx8.jpg" "
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1tbk6ea.nwx8.jpg"
      4⤵
      PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1kpxbao.tegz.jpg" "
    3⤵
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1kpxbao.tegz.jpg"
      4⤵
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hka6kt.3hmp.jpg" "
    3⤵
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hka6kt.3hmp.jpg"
      4⤵
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1yaxwbl.1x32l.jpg" "
    3⤵
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1yaxwbl.1x32l.jpg"
      4⤵
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11rk489.xcw3.jpg" "
    3⤵
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11rk489.xcw3.jpg"
      4⤵
      PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ajgale.0fotc.jpg" "
    3⤵
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ajgale.0fotc.jpg"
      4⤵
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16ttuuo.gt6hf.jpg" "
    3⤵
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16ttuuo.gt6hf.jpg"
      4⤵
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m24wda.6sqh.jpg" "
    3⤵
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1m24wda.6sqh.jpg"
      4⤵
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-tpas75.tcrw.jpg" "
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-tpas75.tcrw.jpg"
      4⤵
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-k1tnmt.vq34m.jpg" "
    3⤵
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-k1tnmt.vq34m.jpg"
      4⤵
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-i08qmg.bzuig.jpg" "
    3⤵
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-i08qmg.bzuig.jpg"
      4⤵
      PID:2460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1wsvdvj.n04yi.jpg" "
    3⤵
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1wsvdvj.n04yi.jpg"
      4⤵
      PID:580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ksn5ks.ra3p.jpg" "
    3⤵
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ksn5ks.ra3p.jpg"
      4⤵
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mu5j9v.2h2tf.jpg" "
    3⤵
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mu5j9v.2h2tf.jpg"
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-er8wuw.miu6.jpg" "
    3⤵
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-er8wuw.miu6.jpg"
      4⤵
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mz1kyw.v7hxg.jpg" "
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mz1kyw.v7hxg.jpg"
      4⤵
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-eakgix.r5r4f.jpg" "
    3⤵
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-eakgix.r5r4f.jpg"
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1xexv07.rs0ik.jpg" "
    3⤵
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1xexv07.rs0ik.jpg"
      4⤵
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1l44vex.x8gw.jpg" "
    3⤵
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1l44vex.x8gw.jpg"
      4⤵
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-blt5x9.9fapk.jpg" "
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-blt5x9.9fapk.jpg"
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-wodnok.kpqf.jpg" "
    3⤵
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-wodnok.kpqf.jpg"
      4⤵
      PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qujxiy.nadia.jpg" "
    3⤵
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qujxiy.nadia.jpg"
      4⤵
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11v8i7v.z2ca.jpg" "
    3⤵
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11v8i7v.z2ca.jpg"
      4⤵
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-4wwycz.4egyu.jpg" "
    3⤵
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-4wwycz.4egyu.jpg"
      4⤵
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16trfgo.61uo.jpg" "
    3⤵
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-16trfgo.61uo.jpg"
      4⤵
      PID:856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-18fxzrs.ivku.jpg" "
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-18fxzrs.ivku.jpg"
      4⤵
      PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mrhnf8.h3qyg.jpg" "
    3⤵
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mrhnf8.h3qyg.jpg"
      4⤵
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ksgj1v.37huf.jpg" "
    3⤵
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ksgj1v.37huf.jpg"
      4⤵
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ol6iro.gavng.jpg" "
    3⤵
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ol6iro.gavng.jpg"
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ixyyzx.f8l4a.jpg" "
    3⤵
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ixyyzx.f8l4a.jpg"
      4⤵
      PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x5g72w.9s7wg.jpg" "
    3⤵
    PID:340
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x5g72w.9s7wg.jpg"
      4⤵
      PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-bkd0l2.52edt.jpg" "
    3⤵
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-bkd0l2.52edt.jpg"
      4⤵
      PID:868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1xosbs0.t4te.jpg" "
    3⤵
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1xosbs0.t4te.jpg"
      4⤵
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-q3xxkr.ir7a.jpg" "
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-q3xxkr.ir7a.jpg"
      4⤵
      PID:912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1bkr865.ke9n.jpg" "
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1bkr865.ke9n.jpg"
      4⤵
      PID:608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1v807wv.b6rtk.jpg" "
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1v807wv.b6rtk.jpg"
      4⤵
      PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ar64mc.hz9e.jpg" "
    3⤵
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ar64mc.hz9e.jpg"
      4⤵
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-7kq9vo.2vjrd.jpg" "
    3⤵
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-7kq9vo.2vjrd.jpg"
      4⤵
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5dz3gi.azhxb.jpg" "
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5dz3gi.azhxb.jpg"
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yf59m1.c7m5t.jpg" "
    3⤵
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yf59m1.c7m5t.jpg"
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1nw64c2.gjxg.jpg" "
    3⤵
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1nw64c2.gjxg.jpg"
      4⤵
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qakiqz.56ffp.jpg" "
    3⤵
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qakiqz.56ffp.jpg"
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qm97se.vn7gf.jpg" "
    3⤵
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-qm97se.vn7gf.jpg"
      4⤵
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x4gyjx.lpxb.jpg" "
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x4gyjx.lpxb.jpg"
      4⤵
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1f1u0jj.wcp2h.jpg" "
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1f1u0jj.wcp2h.jpg"
      4⤵
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1720rso.dttq.jpg" "
    3⤵
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1720rso.dttq.jpg"
      4⤵
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-52b3we.4pcfj.jpg" "
    3⤵
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-52b3we.4pcfj.jpg"
      4⤵
      PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-p61p4.tbto4m.jpg" "
    3⤵
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-p61p4.tbto4m.jpg"
      4⤵
      PID:324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13zha82.p28f.jpg" "
    3⤵
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13zha82.p28f.jpg"
      4⤵
      PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14inbwi.8lcf.jpg" "
    3⤵
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14inbwi.8lcf.jpg"
      4⤵
      PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-v5qk11.oikf.jpg" "
    3⤵
    PID:692
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-v5qk11.oikf.jpg"
      4⤵
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ojui5t.vijg.jpg" "
    3⤵
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ojui5t.vijg.jpg"
      4⤵
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-n436yb.gclzl.jpg" "
    3⤵
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-n436yb.gclzl.jpg"
      4⤵
      PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1rcjz3.9dgda.jpg" "
    3⤵
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1rcjz3.9dgda.jpg"
      4⤵
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1chua60.qegt.jpg" "
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1chua60.qegt.jpg"
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-12qssp3.ed9y.jpg" "
    3⤵
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-12qssp3.ed9y.jpg"
      4⤵
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6hyo9x.2i59d.jpg" "
    3⤵
    PID:716
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6hyo9x.2i59d.jpg"
      4⤵
      PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1z0b3k7.a60tf.jpg" "
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1z0b3k7.a60tf.jpg"
      4⤵
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13469c9.zodhf.jpg" "
    3⤵
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-13469c9.zodhf.jpg"
      4⤵
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-h9pxuj.ck9sb.jpg" "
    3⤵
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-h9pxuj.ck9sb.jpg"
      4⤵
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-d94cvv.11w1.jpg" "
    3⤵
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-d94cvv.11w1.jpg"
      4⤵
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-zmidyc.8si3g.jpg" "
    3⤵
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-zmidyc.8si3g.jpg"
      4⤵
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1iipcd4.q4vr.jpg" "
    3⤵
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1iipcd4.q4vr.jpg"
      4⤵
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-w3lto0.bcxuk.jpg" "
    3⤵
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-w3lto0.bcxuk.jpg"
      4⤵
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jowjy7.yizo.jpg" "
    3⤵
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1jowjy7.yizo.jpg"
      4⤵
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-c2vk0y.418ap.jpg" "
    3⤵
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-c2vk0y.418ap.jpg"
      4⤵
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hwqwqr.x342.jpg" "
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hwqwqr.x342.jpg"
      4⤵
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gx6pbj.yawbh.jpg" "
    3⤵
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gx6pbj.yawbh.jpg"
      4⤵
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1fpugem.64i4.jpg" "
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1fpugem.64i4.jpg"
      4⤵
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1p6694i.bom5.jpg" "
    3⤵
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1p6694i.bom5.jpg"
      4⤵
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-10sb1s6.1xsp.jpg" "
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-10sb1s6.1xsp.jpg"
      4⤵
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-lebqr0.zaak.jpg" "
    3⤵
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-lebqr0.zaak.jpg"
      4⤵
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hwlafs.lqr7.jpg" "
    3⤵
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1hwlafs.lqr7.jpg"
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-40st8j.ayi5g.jpg" "
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-40st8j.ayi5g.jpg"
      4⤵
      PID:668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1v5cznh.gc98.jpg" "
    3⤵
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1v5cznh.gc98.jpg"
      4⤵
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-c2d41b.0ezd.jpg" "
    3⤵
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-c2d41b.0ezd.jpg"
      4⤵
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dj71ec.ft065.jpg" "
    3⤵
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dj71ec.ft065.jpg"
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1td7v1d.chpc.jpg" "
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1td7v1d.chpc.jpg"
      4⤵
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mzva5c.vkfvk.jpg" "
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1mzva5c.vkfvk.jpg"
      4⤵
      PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1pga1tx.lgkg.jpg" "
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1pga1tx.lgkg.jpg"
      4⤵
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-24u61p.u85x.jpg" "
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-24u61p.u85x.jpg"
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-9rjs38.yic9k.jpg" "
    3⤵
    PID:304
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-9rjs38.yic9k.jpg"
      4⤵
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5syue9.u4e5w.jpg" "
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5syue9.u4e5w.jpg"
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1l8u8dw.367cj.jpg" "
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1l8u8dw.367cj.jpg"
      4⤵
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-fjmksm.gy5ph.jpg" "
    3⤵
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-fjmksm.gy5ph.jpg"
      4⤵
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-kqj98a.u46k.jpg" "
    3⤵
    PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-kqj98a.u46k.jpg"
      4⤵
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ddsayv.i9ic.jpg" "
    3⤵
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ddsayv.i9ic.jpg"
      4⤵
      PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dis7mg.zcjhq.jpg" "
    3⤵
    PID:580
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dis7mg.zcjhq.jpg"
      4⤵
      PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14fowma.ygkn.jpg" "
    3⤵
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-14fowma.ygkn.jpg"
      4⤵
      PID:2916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1xb871u.lw2o.jpg" "
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1xb871u.lw2o.jpg"
      4⤵
      PID:2324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-nlc1a3.vxjfj.jpg" "
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-nlc1a3.vxjfj.jpg"
      4⤵
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-627fcj.54xib.jpg" "
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-627fcj.54xib.jpg"
      4⤵
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-8r12nz.o80c9.jpg" "
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-8r12nz.o80c9.jpg"
      4⤵
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1tkg2bx.8gzd.jpg" "
    3⤵
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1tkg2bx.8gzd.jpg"
      4⤵
      PID:2568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1vkkvsx.m1hs.jpg" "
    3⤵
    PID:340
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1vkkvsx.m1hs.jpg"
      4⤵
      PID:1136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-iufwl5.cglzr.jpg" "
    3⤵
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-iufwl5.cglzr.jpg"
      4⤵
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-y5mcz1.0tfgm.jpg" "
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-y5mcz1.0tfgm.jpg"
      4⤵
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1dxxa52.dwg2.jpg" "
    3⤵
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1dxxa52.dwg2.jpg"
      4⤵
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1fm7s9y.vbwq.jpg" "
    3⤵
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1fm7s9y.vbwq.jpg"
      4⤵
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17jkpij.7a4h.jpg" "
    3⤵
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17jkpij.7a4h.jpg"
      4⤵
      PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6hewro.g1bkp.jpg" "
    3⤵
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-6hewro.g1bkp.jpg"
      4⤵
      PID:2240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-170wq3m.9fga.jpg" "
    3⤵
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-170wq3m.9fga.jpg"
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yf22u9.jf07d.jpg" "
    3⤵
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yf22u9.jf07d.jpg"
      4⤵
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-e87bu1.pxbg9.jpg" "
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-e87bu1.pxbg9.jpg"
      4⤵
      PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gw1zvo.n72pg.jpg" "
    3⤵
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gw1zvo.n72pg.jpg"
      4⤵
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11kok5y.e6mh.jpg" "
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-11kok5y.e6mh.jpg"
      4⤵
      PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5a5tue.z24g3.jpg" "
    3⤵
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-5a5tue.z24g3.jpg"
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cyk8jt.6d34h.jpg" "
    3⤵
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cyk8jt.6d34h.jpg"
      4⤵
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-12vhhlr.sqvm.jpg" "
    3⤵
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-12vhhlr.sqvm.jpg"
      4⤵
      PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-db3pd4.73i3w.jpg" "
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-db3pd4.73i3w.jpg"
      4⤵
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-amjqx8.9h9jn.jpg" "
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-amjqx8.9h9jn.jpg"
      4⤵
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-sjz1en.nhei.jpg" "
    3⤵
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-sjz1en.nhei.jpg"
      4⤵
      PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1j55p1p.6zhi.jpg" "
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1j55p1p.6zhi.jpg"
      4⤵
      PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-jxu47k.2qbn.jpg" "
    3⤵
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-jxu47k.2qbn.jpg"
      4⤵
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-y4ubjp.skglq.jpg" "
    3⤵
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-y4ubjp.skglq.jpg"
      4⤵
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1rtyuuu.oetf.jpg" "
    3⤵
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1rtyuuu.oetf.jpg"
      4⤵
      PID:596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1tw2okh.w6g2.jpg" "
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1tw2okh.w6g2.jpg"
      4⤵
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1qol61i.8h1zi.jpg" "
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1qol61i.8h1zi.jpg"
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-139axhg.up4z.jpg" "
    3⤵
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-139axhg.up4z.jpg"
      4⤵
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gbk1i9.1mf4l.jpg" "
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gbk1i9.1mf4l.jpg"
      4⤵
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17fiwc.exc7u.jpg" "
    3⤵
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-17fiwc.exc7u.jpg"
      4⤵
      PID:108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-19aax4o.zold.jpg" "
    3⤵
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-19aax4o.zold.jpg"
      4⤵
      PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cy31v3.27t5h.jpg" "
    3⤵
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1cy31v3.27t5h.jpg"
      4⤵
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mpoex2.0pzl.jpg" "
    3⤵
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-mpoex2.0pzl.jpg"
      4⤵
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-cjvlwa.2l0ss.jpg" "
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-cjvlwa.2l0ss.jpg"
      4⤵
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-z43u9x.uip2.jpg" "
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-z43u9x.uip2.jpg"
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ekbnws.3gna.jpg" "
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1ekbnws.3gna.jpg"
      4⤵
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1bnd22v.3dh9.jpg" "
    3⤵
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1bnd22v.3dh9.jpg"
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1t56igf.m0zt.jpg" "
    3⤵
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1t56igf.m0zt.jpg"
      4⤵
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1yra931.xc8n.jpg" "
    3⤵
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1yra931.xc8n.jpg"
      4⤵
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1o5e8ij.1chch.jpg" "
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1o5e8ij.1chch.jpg"
      4⤵
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15yy1r6.4bd9.jpg" "
    3⤵
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-15yy1r6.4bd9.jpg"
      4⤵
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-oo06cv.uwxd.jpg" "
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-oo06cv.uwxd.jpg"
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1nut2y9.7y5.jpg" "
    3⤵
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1nut2y9.7y5.jpg"
      4⤵
      PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1uuvxts.bx6mk.jpg" "
    3⤵
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1uuvxts.bx6mk.jpg"
      4⤵
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1quhnkc.lt1c.jpg" "
    3⤵
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1quhnkc.lt1c.jpg"
      4⤵
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ig842p.396ja.jpg" "
    3⤵
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-ig842p.396ja.jpg"
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-u23y56.c77e.jpg" "
    3⤵
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-u23y56.c77e.jpg"
      4⤵
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-imrpaz.3oj4.jpg" "
    3⤵
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-imrpaz.3oj4.jpg"
      4⤵
      PID:580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yb576y.nygco.jpg" "
    3⤵
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yb576y.nygco.jpg"
      4⤵
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gujoy6.xurg.jpg" "
    3⤵
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1gujoy6.xurg.jpg"
      4⤵
      PID:596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yp51te.mty3.jpg" "
    3⤵
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-yp51te.mty3.jpg"
      4⤵
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-a2y9qn.92owq.jpg" "
    3⤵
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-a2y9qn.92owq.jpg"
      4⤵
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1vs0fob.8p4t.jpg" "
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1vs0fob.8p4t.jpg"
      4⤵
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-xjxtn6.zlx1.jpg" "
    3⤵
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-xjxtn6.zlx1.jpg"
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-wn2ar7.34sb9.jpg" "
    3⤵
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-wn2ar7.34sb9.jpg"
      4⤵
      PID:340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1e62p2s.0ks3.jpg" "
    3⤵
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1e62p2s.0ks3.jpg"
      4⤵
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x1tn59.vyfif.jpg" "
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-x1tn59.vyfif.jpg"
      4⤵
      PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1b7l61g.wsbm.jpg" "
    3⤵
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1b7l61g.wsbm.jpg"
      4⤵
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dnvie1.1friv.jpg" "
    3⤵
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-dnvie1.1friv.jpg"
      4⤵
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1kquzsg.8288.jpg" "
    3⤵
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
      screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\2024318-1836-1kquzsg.8288.jpg"
      4⤵
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024318-1836-ovzqq1.bt8gs.jpg

Filesize
16KB

MD5
30e7343b1d21e7670949f608dc8081ef

SHA1
4862419ba9c1bdaaaeeae1cc94abff6383e313b0

SHA256
4fa573007feb0a3dd69a4913849ddb36128861231af29b7c4de620e67697cdd0

SHA512
890e4f1dabc7421882ca5fa4b37033c8621933072f426f86ec3e4e0b53e10382b4154913b9d5a09837e25862bfbe872c5793cf93fc9f624bf119656f4695eb27

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
53.4MB

MD5
aa4d1425ece7242f5aea1f03743b2c51

SHA1
4133407e8f2df2c5ef55c6ad9ec5f7549776a2ad

SHA256
0f40dac17cd196a310d0d7d834bc5cf047cfbcf5832e2782fafb21f3e5bcd4c4

SHA512
f894bf1097c1d0586c6960bebd9093aff1fe5df8a3f5198286d4cc8d19310cc2920159b90777313e688d2f7f4d577dfd4bf87855f85bcc7de92ea271ec557f11

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
45.3MB

MD5
82a646e03c3a7c5303d6fd1cbbf0c181

SHA1
12b56f19cc60e996dc0e9ef321f2df15749c55aa

SHA256
e56742b56c25719025dbd193803869e61d53b1a6548f151def8bce5828d91288

SHA512
6194f4a317184b2abe6d0262792441d8718317ed467672bdf37008c7cc5ecd3510452b8d80d5cef20fecb37f3fae5ee486d681b62b4376c0d15e8dd060916876

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
46.7MB

MD5
d80748951878da908e26109cf212e2ea

SHA1
750ad2cd2622484c9e74f1a53f306fa95d9579c2

SHA256
f2681d00b2af80057fb8d336228786a3d2c57c30bf60058cd5af644256dd9647

SHA512
261ea9f2e93fdda7ccbeadec686b744b3f04b669e95c8b5829f4ad054837db15b28e954112886ec05109628fa56b4338b831cac1af2fa43345053933edd5b3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
47.0MB

MD5
740f197570961d562dc241d44aaf8ab2

SHA1
45a6f858269c5c267b4698c59b03ed939f44c358

SHA256
b253dcec4497654fb0a31921b7c6e1849df8828c058e04467621b946c4d97c52

SHA512
fc71a569d9fba5b9b0c30223dacb89e082604771f66b07d293593a6c0723cc67a2a285aacec5b8cf1e7385703d874f1f7903875f7c37640f8dac69c444ccdf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
45.9MB

MD5
b9890d30bfc1b47c6e7bb936e92c7287

SHA1
b654354fffb6202768e8a16a4a2207559456ff8f

SHA256
0b741d3d417447ef2d020ce025a4ae677b940449973c207d39a042bab5f9e4a5

SHA512
0a1d093802fea1fe48bec7bd630ee762da4bc2d291f3e4b1107ca1223d4470ee2fe9a0d3d8d90c4a1c2f869ebbbf2b88f57f2756a6c9bae9ef24d987db13608d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
46.1MB

MD5
b5dadd866a6482085d91dc7ebfba2f22

SHA1
461407864f381069e175847e7bd44c98a63bbe87

SHA256
bdae9945eecffa01df30c80bd42563576f955778ec11022f680ccc8d292b7cc9

SHA512
64b319f248d268150ad98d01a31f72396ab6d47c6487d0857ba9cc31ceb2f5c96d33f8ee9a4f63b3ab80e4c4f0ab56f554e61df99ede257f450662e4d07bbe3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
43.5MB

MD5
1677830c962abdeab0f07e38978bb47f

SHA1
7ce0971f56230aa1560dc4d7de0657ebbcb6f78a

SHA256
0ca5fa4d15320a7017f081110da03c8c963af5c6016b8824385680b29bf0023c

SHA512
8b8de3dd6ac09e04de638664b784961b2df4d6ca6da64f4a787edb5541cf0cbf7d5e92d23ca6fa4fc77efc89e0b2682f1fba0fff1559f79cd38fe8f1e2841ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
42.8MB

MD5
466211a81a2f71b5bf36dea5f1c09eb4

SHA1
07758c760b2439c6758d8afc274a9c10a3d8ed8b

SHA256
dcfc868becfd9fe0ae10f28cd12331714f006612b4dab097a31f671259bc06a5

SHA512
a350614c71638fb614a2212cc0c65b1b75a2d6f54d15a23e13c3ce031d4e9de6c7bd77b4d35a60861ba5d25a7ae0d6584e673ae79db7ddf953466589259a08fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\resources\app.asar

Filesize
53.0MB

MD5
a91ad4fccf20779a11baae728ec3a877

SHA1
489b66f9ec6d2a7001447e3574ca849549312e1f

SHA256
4efe4807d999a69d07f4b839c632238557e720d945d4ad2ca207bc317fb4fda0

SHA512
0cea2a28f4d4815d35b42ef3306ec4a504c214c8a47ea50c7da5c016d08a8ada81404772efa558b18c02ff6aa56e538813c44538ddc809855a094e77943b5e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

Filesize
240B

MD5
810ae82f863a5ffae14d3b3944252a4e

SHA1
5393e27113753191436b14f0cafa8acabcfe6b2a

SHA256
453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c

SHA512
2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\EpsilonFruit.exe

Filesize
51.8MB

MD5
86c49e8aa4fdd39898875068ee55df44

SHA1
02eee5015b7ed0b1398774ef426d3a937135804d

SHA256
5698c700ac5b1421e4a69d2c97affa68db577525dd9dbcd05a75219a4740762b

SHA512
fa324e5b330b8a432bbc4b5280b6ed332716210e23807e14da9f7cc72aa5bbba499bb1595476a46209835f94096a4a6c2ab8c7ff3882fe4d08c932d997f704a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\LICENSES.chromium.html

Filesize
5.2MB

MD5
df37c89638c65db9a4518b88e79350be

SHA1
6b9ba9fba54fb3aa1b938de218f549078924ac50

SHA256
dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463

SHA512
93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\chrome_100_percent.pak

Filesize
138KB

MD5
9c1b859b611600201ccf898f1eff2476

SHA1
87d5d9a5fcc2496b48bb084fdf04331823dd1699

SHA256
53102833760a725241841312de452c45e43edd60a122546105ab4020ccef591b

SHA512
1a8ec288e53b9d7e43d018995abe4e3d9c83d329d0561fbb7d022e8b79ffecf033e995b9bc6af352a71c646a1e8afba4addb54deab7455f24b7a279a3dd7c336

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\chrome_200_percent.pak

Filesize
202KB

MD5
b51a78961b1dbb156343e6e024093d41

SHA1
51298bfe945a9645311169fc5bb64a2a1f20bc38

SHA256
4a438f0e209ac62ffa2c14036efdd5474b5ecaa7cbf54110f2e6153abdfb8be9

SHA512
23dedde25ad9cb5829d4b6092a815712788698c2a5a0aefb4299675d39f8b5e2844eabd1ea42332a0408bd234548f5af628e7e365ab26f3385ebfa158cdd921d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
12cb29b61007fd6cd166882635241038

SHA1
31bacefd2d7238fb5ac77f728bb39a27b400dbb0

SHA256
2e60bc5a05d3e98d12d2bd577d63b6dc77bd1b3734633259fcaf50fa3688ca9c

SHA512
cbfab7708a01fe47904facfdf9604025d6f1c680e40ada0b4c1b1ef35a4eab7de5de96c22d0491c6d202175d2c66693216efab6cfab73e316d466811d834b126

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\icudtl.dat

Filesize
9.8MB

MD5
599c39d9adb88686c4585b15fb745c0e

SHA1
2215eb6299aa18e87db21f686b08695a5199f4e2

SHA256
c5f82843420fa9d144e006b48d59ba7ef95f7e6cb1ea95b27fcdd2c97f850859

SHA512
16194186a8407b29f799d4b02f5674e4fbd5d91163fad9f8dce6ceedd865b754a681aa960d0f3f1b62cb21d5443879f1b8e9b691c19c5802d5bdfe4ed645b8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\libEGL.dll

Filesize
437KB

MD5
979b72ca6e98fc7fdcfcc50d77906fb5

SHA1
dc4b874f495ed73c90b39feb566a48a081371c4b

SHA256
73d1f5880980a2ccb8e5a15e285a4a11fccd80754829e85aa9a3b8ffecf39dd9

SHA512
bd4d25a591d1c52d9a4a850a5bccbbf5ec8d174f5f093c0fd611a18af8d337b918464220a4f9591d03582aadf1c9cb392596a5449fb7d0a928889b0f65f8c619

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\libGLESv2.dll

Filesize
6.7MB

MD5
5300049a47fd88310ef94f9e37eeb247

SHA1
89672d16382a75781eeca002c850c17cfc46e851

SHA256
33863ea4047e4eaae8f24bfa3491bb809d4c3d44489ae2bbe5e3af9e5cc1fe50

SHA512
b38ef83cb40923654ae1efcdb8af63e1fb47f640a0cbeac350b97f24da1365da23d757cacef1f9e994ace0b076b4bc1408644347aec3c94995bb27d184a93c09

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\am.pak

Filesize
180KB

MD5
b319cd4192f5bd03bab4644ee51e4ebc

SHA1
49c52f43f542022a97d2ae18a56a266deb901496

SHA256
ab1d0f3bedb5806fa7268773b6193928cdb40e641d8563c14df1bf962434d5f2

SHA512
3fe8284422bb7de7f2e3e121b8657b7686586d597b4d453b2e38f119fd25bddd61c1218f22cc8e4bbf37f393411bb866c0d6c166207b5bbfeb45f5459e29e370

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ar.pak

Filesize
185KB

MD5
d7eecfb7cc52b3dfb69d8047dc6aa12d

SHA1
fa5e4e98395c4bb14259c2e3c36fc84b55f0c3d5

SHA256
e38cd21fb917db4671ab331ee505948e109e2a0c6a2f3ad0e64d09863efb7df8

SHA512
2ebc6f7749e50bb3a9c27d2235be1478fc2d58a7b6f5c4cbbda09ad4f28ee3873881dda16ea668eeb63dd259a23ac68c73e4ab4295d51a22c36284d9c8667ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\bg.pak

Filesize
202KB

MD5
8448caa7a70f74dc0c6e453e7487bedb

SHA1
a7f67df94ee9532d26c6e6e827d61414f4516d0c

SHA256
19f49a247dfa1328799a1be9a556d940618ceefc04a5dfd813e5c023d086a41a

SHA512
337293839e64f514152c7558f2d1cbb301730675936ecfc11242d1346c9da535896dddaa8ad563a40303cdc8884f80af679c324b31325d40b7141a8738ab14bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\bn.pak

Filesize
261KB

MD5
124d35950327fec461c07dfb6dde72eb

SHA1
f3d7791dd6bdf88f65a62ec2e8170ee445b6a37a

SHA256
def934201f35a643c8b097be42fe86f2a08cef5523cb61e2d94cb33ae373f502

SHA512
05a993c9ba52083b8a7f0b3662eb8e4a873d23f309d334cb4e4088fa5e33d8503fdc6d19f247c4920cdd91a165995c514b2a061c26fc44f89e864516ffdde9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ca.pak

Filesize
126KB

MD5
90d8b16ace2fc684d0ddde0d71f64831

SHA1
ead7dbeffb3c102d3547c8c256135991b547ade9

SHA256
020350f4a902c79e0f1f5366e209b2c309ac51b6e72d9ccf51cdde2fab756e3e

SHA512
bfeec65e7c001d7a29c18e6bfc2b4c6688c828419d0e9823d524a7b35c24a3303c1cfb8f14a98d965d4ab41c5110842ec64cb7a2928309b0bd31291e85b168b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\cs.pak

Filesize
129KB

MD5
2c9e55ed46954a8eaa27105f3f074ca2

SHA1
bb4a36964cd1e8f140c9937586b5215fbd7a9632

SHA256
86f1847450d5c341893fa097fa6d4e0964963c0c2466a985d014dab0b65f34e6

SHA512
cf7141a3db9d44c0940e88ded1f326b5ca4031d18f8a8236b313c6a6c41289e9dfd12c3367181edcbd5425deb584b082df004bd6db0ca55a1da151703af575bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\da.pak

Filesize
117KB

MD5
66e780528890dc0f484a3d6938ac281a

SHA1
5f46f7915cf101b88d29213b457f37e24d5a083e

SHA256
e698945093c1f562d0e591c03d9670a9b01d0eaa56a2c80c1d12d91d88b7b407

SHA512
9cbc2b054bd3f9d39050a4a189fcf0127a43b9991ecdc9453679c53b38cf8a25138057648a756e01fc9b4825c009a8894ef68b94faca83cd35d268fb05556af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\de.pak

Filesize
127KB

MD5
8e560e240bb79e453167f70409226619

SHA1
bde183d2191d42797a300f0c4cd83e1db278c928

SHA256
61c4a4b5c309128ba86a5345db04798be0680905543c6986f7b3cc4b1ba72729

SHA512
5564555eb203fe86e9630dc223e4012c7e3501d68554b6b7138a3c6064d39b868e7e2e0e8b994169e918e9c6f67066440b89c7ab10f48731a84fab84c2e7ff82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\el.pak

Filesize
223KB

MD5
b3724a4dcb17bd341da403acfdff0bf5

SHA1
05fc9eb29381f1befbafb937c564a87205779264

SHA256
0adb6e5173572ab4a3df5671cf053196f158294bc1e07275a7e6fb6d8da81b06

SHA512
3ccd57eb43840573bbd7e6d8b24028213acf58040b2795a975ca4750e4a9500d8af74bebac1b47f2d9b87204c68707d53b0d927c0aeac1fa1bfdb1c899e66f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\en-GB.pak

Filesize
102KB

MD5
05f7b55019ba0a9da84073cec0a954c3

SHA1
b46462fa8c614161ec42fa791e4ce3163c92ea8c

SHA256
a690e642a6b781efc3da2e8c83e554d6e8b9ae6ac34f6f0a4f327dd9ea7cb7f1

SHA512
30e93503db60b8c7a8dc902efa960583316cb83337eca102f0bdafc47d3b59ad5ea1eb99b5b9deb0ff66345d551485963e4c61ce555298880aafcd298057fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\en-US.pak

Filesize
103KB

MD5
b58cb46758c6bc8fe4385ec2ce4e50b7

SHA1
34026e96e02220cea46a31c2319f695ca2e0a914

SHA256
e34c459684971971765943e8b5b2d1751b329a9502f0fd6649679823f725b8c3

SHA512
702384f9d6d77da08fc8c49a5f65957c56e363e1ad37f9d0611092d248db1f79636a6cf336e55669e002194f589f584b5663b4d77e54fa95e18f84eb4864d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\es-419.pak

Filesize
124KB

MD5
f9958dd6ce0ce1acea070bbf317b1160

SHA1
0dbc4020e505a053cdbe6a0a9506829498a8a25c

SHA256
ea868929f537d48e846f86020762c59c77a0ec67765c3af22e08fcc853f94c2e

SHA512
35a6e5fdff6b4e3a076eea70b7c551f1d303b4db4e63aabbbde54b4fefe40d750a03440bed7851f12750661ff8b87c5ce3382b0c71d0e171f729a7a82f968cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\es.pak

Filesize
126KB

MD5
09e0feb85585bb4a220a3ab3f21adb9b

SHA1
e564afb37d5f5305585ad1081a26b34ebee73ccf

SHA256
cf7ea140dceac78042e0d35da45a4fe732eb04e1d2b138bee4cc2dc5e7e9a0fa

SHA512
8317bd2b4f509edabac1a74ec32bcfd54b14598799537d90178ec349cd71fe967d5c677403c85e305a6f2e94722c20a83e65c0bdb29a6265c5355683856f4ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\et.pak

Filesize
113KB

MD5
3ca246cd997a68bb4a6daa8b3b81908d

SHA1
842bf5f6bdd29ccccb24ea412497acdb37a5f805

SHA256
25c1e1306160779466d8c039ea296db65d12dcf21d2ad794a36ab62b1a7901fe

SHA512
32135a0c29bf666833292b557634d4510c185f711d7ad8625e981811ea082dca0d1714f481c9c8ce8b3acefd18469093d48fc05bc0160ffb87d1e2b90f4cba1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\fa.pak

Filesize
179KB

MD5
46412682e8d0743714fc28a520aeb35d

SHA1
dc6bd723efd460a56d205bc199e3be4c98698ba4

SHA256
9861d5260b98b384603ef02e97dac0295fd255e550b57fd427bbef24b1cd7b17

SHA512
c77c5344c6a7af4035f865aa7e3a3aaab39b11c4a3bdd94aa99f15dbc6ec7cf4b6057ff48fd55e2ff41041728fecf80dcd488578dc1db249ab1b7598fa438f14

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\fi.pak

Filesize
115KB

MD5
a3b5292c5e2e981dc4ce9504f638a542

SHA1
6cf480f3d7cb5df71bdd4089a1821f2eb2dacecc

SHA256
f4f2438a3810ccda4740442cdd964e43883cdeb820715cbd7be03cfa6b1e55ed

SHA512
6ed819896e2aa72d73bd2af731f7f714119fbe7d1fce5909d1a9d9ecb99c6369505e6d33f1f9ebadcb0da608f9aec365bc6cb5f6e22373d577cced7e317772c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\fil.pak

Filesize
129KB

MD5
7c3df3c13393e1b24e4e96f2b9082a6a

SHA1
caae1c99b589e14184e9f2c89f698a2558f4ec3c

SHA256
27196aee4a6248bee44ea2b5a3de90ccc2cd53f8ce1beeb796aa4d7e25bd43ae

SHA512
2d85d37d9560cd6ff460e32c3c569851ae28d794b5319ce74c010cad527c4004e54c993d5440bd22d6e51d86c4c4683f8db03c38abca4839a10e2efe46ae35e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\fr.pak

Filesize
135KB

MD5
a17cca5f1db7cedccda9c5a7784bebd0

SHA1
c5e0a0d24a14a535406886c00ad10d20638341b4

SHA256
e8da96855f7238a6ee3162b08d46e5ab84d98179dabf535060ef5fccdb36bc79

SHA512
0bb2217e44f1c8cd9e4cc2127454e1fd137c6fa101914bd230b9089d6317f599c9dfdddafe3d5cbc0fdc036e7b4f6e5cb528bddc572b5e26c8e0322f1a7d0b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\gu.pak

Filesize
252KB

MD5
10c1dc999bc7ab62e1f26b0497afa7bb

SHA1
68da1055b8acdf016b152a2f401322d3d76885b5

SHA256
b9690f3c550deb0827e409015abf3bcaab01c9acd33e96932e85ac84ff4c7831

SHA512
c10a956fdfab446b74f1dd2a169201f0b7ddc4ff1d7a635b9c81f07942ea0d34ea327e2e7f07e3a672ac85c8b8ce7a0e871d02946da4fb5e8e75713e56cbce61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\he.pak

Filesize
155KB

MD5
5db44f8dc63c819b0ae2a5458e36447f

SHA1
6b440ad4bdef6acd31ca8be5d085db26a49a209b

SHA256
bee5f133cc85f8ca280f9f41df6790aa65161fe8dac8dea7e26fc609240e84a1

SHA512
cd0d104597c5c926480443b5d1a16526ec0e48c3d6dca6233ec7cfa63f01f2f5674d9ac9a86a45b789a94fcb3b63aeaf92351bac2f4920a25dd8d4fcd1edce19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\hi.pak

Filesize
260KB

MD5
815dfb3eeb9a69919ecf2562b6d4ad34

SHA1
2d0fb4c2a19b7a991974783b51b13c7b3610b686

SHA256
a480e95a5cf338a90f7d077e4147f45696db9ad6e8cae1765ccc5ef05fb48505

SHA512
0e6c8374ed7f6f3b523c2dd5455b598ab0650da8ce3a8243a1a42c6327db9a694947a508a90edf95685c84120cc73964a16c7ec49835ea398dcc6186d08ef1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\hr.pak

Filesize
123KB

MD5
ebdf0ad52e9a0f8c8735614775ff5a94

SHA1
787feb9f703daa094814464b090aa5d36725e007

SHA256
b9c21e5187e8649157f5e49e014b8c285866ec839638344a31234b60a17e7d47

SHA512
e2853884687393fa2b0f8e4b27af5664c223fd5bb2862e5ef788f912771eb9d61e7ca1fc39f29ab679f49986b5a95b9da44727c69c99dfd3bb8ea2f4e974ada3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\hu.pak

Filesize
134KB

MD5
4b5fea4bd49738337ab10bb3f1e6bda4

SHA1
0f27220019e099b658a9c563995dc2b022fb1d68

SHA256
e526c9c9a8c4d27c432d3cc30766fbdec6c536b696a7ccb7e9376f0e55147b90

SHA512
4e271f8ca0028ff5b8a86e8610174739d2d2b7a267381562bbac3543d03f6895b3361c2f6fcfbcaea6f5aad1690e878ae0de5c905de12b213c2c5c396caafa66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\id.pak

Filesize
111KB

MD5
39378b548f712608903ee8aa25db212d

SHA1
7f5a3466a4c8609c6bab7ed3dbc9fed52cfe1e62

SHA256
426a302448ec17e313724b38bda9ad4d5c031da48a1ed3690b547b51a06229a2

SHA512
7d2d823445316f5a63df286af2f1e28b90b8e3a04aabc835020b17f690d95f7ba2d0261876495345876cf826fc57dd0a9577e79af7e609adb8c71b8b4ff03550

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\it.pak

Filesize
124KB

MD5
5b03bfc915b62aceb06b9c670fb77e33

SHA1
9c88ef98dea5a7d7be8571354ad3c033033a40b8

SHA256
1f9a38c852c05577aba397c388b35037eec6b9d90593800b5b57bac437b42684

SHA512
b22c4db0b56c136e9263a15bb2a31a9213ac20321b189cb0572bd1f0b0b9989a7e698d94750d9c5d01557f4b247abf9a8cff1940bab03fdb737a8276d96ed1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ja.pak

Filesize
148KB

MD5
640bb80728453be0104566caeeb8eb82

SHA1
362b46036c58421f4b0f9b2f714b21e244aeee44

SHA256
1bfb337c19c9d04bc53df2d2eca6b73c11df33b6fd07a6a3fce5427ef0f38cd4

SHA512
1bd764ec56166ac59fd2acb1ac81140bab2ba7f326c0bbdc9cd30ff6246fcdd98e49310b0528fb0d8a9256ac06ca3e145a3906a1815dbe395d989443650f81b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\kn.pak

Filesize
286KB

MD5
5a599f47d2e2ff1aaf4c8ccf8bafd10c

SHA1
32aa52f2e90348725eb619187272e9c5a7396bd9

SHA256
e55425a4ab6425f60a9389e5c19dcd5bf437816ae09a21cd53750819040143d2

SHA512
7ecb69b70d5782e22ef9047fbfa29c0778e894c5cd987d33d65e68616ba2a42a133abe16f2af70aee4fdcb34c7e8e3d3bc3c556c754a010132610628516ad456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ko.pak

Filesize
124KB

MD5
e2a95b73f9081efce223a180b7791c16

SHA1
addd6ac05707597b917ff9f7c3f7524be26df7ca

SHA256
afac9566a4e1fdb2be75faee46bf9182f81b85373d60cb583f1051b12d9719e9

SHA512
70eb91347c21f0e648e9fcf82ffbef5e3eeb6c0268f85fddc7ad4eaea2e22eadeab653476196240a75361505f40b0bdf8602b0f414faaa77354f0fe76ba4e09c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\lt.pak

Filesize
135KB

MD5
720c1b3c95e8613f2cd9e40f3d160ed6

SHA1
1ea62b51f1a2c80b92e3348de260032427a9c79f

SHA256
51027bfd566fa26cd561f9bbfd2b4a6d2e41e0ddd786b7338cecc43423b3e6d5

SHA512
32ad5243df09d642e058550d2ec58a8a8de00cc442da551c195958a95af7c82c4d2b63b27d474a065b0ced5680d3e005b2a36301d02fca09413e165089f47822

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\lv.pak

Filesize
134KB

MD5
fe9ff0063f35ba05d27cba720e2e69d5

SHA1
16a87c24f027eda9865df7090ac8023c7ae5b57b

SHA256
43bf3b7181b607d8769da6c2cf671e2a429439aee253dd774ab5bf5aa5fedde0

SHA512
794b1b87ca400798574be56cf8da9adef78f1f9f91dd42fb23e6355caf0455f8d982f2b3d9bc252673704375eb4ccf32d58ed1cbbadf8780590e5777ef41c035

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ml.pak

Filesize
302KB

MD5
a66617706e80fd5ff8ab6ba8dadafef8

SHA1
3718d0afa1bff72ad7164e41cb46981811583422

SHA256
51b2c600046abfa5774b85665d4c882daa3c90bad5559185f9335ff61f04fede

SHA512
4de6fabef9db34791d0d165b5064e68ffa19630482219e4c72e6dc0f9e9e56b1941297862bb2e267cc02c3d3327193a233f642b11cf74e1892270721a2d7dc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\mr.pak

Filesize
248KB

MD5
da44d4ade4c258629118dbf534f0c2cb

SHA1
d93756c9d2d2db7755b4b7d47042a451435cca7d

SHA256
fcf1d938863cbc4d4a1d62de0eacbfd17fee4a0f5a9fcc09627bc22a98e268c4

SHA512
827c291ccfea31799e2fd48ee35aa179006a7bb3420c0346b5f1291abb4560f84b952a2bae820ef129ad77719edb16873328e7f0d030f9e2970e0c620fe59328

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ms.pak

Filesize
115KB

MD5
63c4977a1e8f5ab37881705d084b47ca

SHA1
f716932d886b8a5441397dd6a8625cef88e85bcb

SHA256
8b18fef24ad28663e4dc5a5113a35111a78b848d70ea7fef4156ad75bdb4fea9

SHA512
3afd4f8db5a0880319b13009bcdc14892b8710b2ac91dea8641f1f632866ac564791f1d302e1208aeeb9977e613fefd6bc7c0a0fd5cb5d031a768362bc0d85ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\nb.pak

Filesize
114KB

MD5
23d5480b833f65f1f55cc3bbfbdf53c0

SHA1
639eff4556e4d6c879abf305176f23c014927042

SHA256
7ce821732e743c2da1f81527355226df11a21eec137940a034afeb34618c5daa

SHA512
b46b25a4dc294dab0f34e5ec733dfe7e1c73c6ce2817640a620e9a0c196292a7a4737f0f10806efba4d5831d5a2f0833925083983927b0d74cbc5c46e9c8b953

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\nl.pak

Filesize
118KB

MD5
6e404adeb945cb7952a8c4129e098759

SHA1
a870715beab03f3a53c74b5aac2f314b517184b3

SHA256
7531e450f725f7ac75ceaeceb09155786d367a4456f4e71e7523af9219748434

SHA512
30917740d923ca25fb9f3c32bca100d58388f5c6d3516a29f3a39d1ca8ab3e4058b271224c8b9554479d91718cca3dc1c9cb08b38b19ccc36a0d57ed0146ab70

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\pl.pak

Filesize
129KB

MD5
def25f809c246d15d8a2f41a78b504c9

SHA1
4462b50e5613b1519987584d974fa0efd1812ced

SHA256
165005f81f071a315d0c4183fb3bc899e464c4cbf2dc450ffa09ae6bb5d517d2

SHA512
e6f17d5426ba98348209a51632db0cfe19287baf3752948bd76acb77b7eca51aae905adf7c316b17cc44856231d034f044cc056b0e0f1ce3b4999dea29597cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\pt-BR.pak

Filesize
123KB

MD5
7b7bf21b01ccfb27af8cd37d738f1106

SHA1
da1db09ee88c005610ed08dcde1b2cd73bcebd84

SHA256
1feb01da1f443fee8ff01c3b585d8f0ebe6a5e242483cf6f0f93088e76913e76

SHA512
ea0bf1357616fd33b41c7189eafd2948324bbfdedb043974dcd0f78693fe868a4d37ee2c0e979d9795cad63cbe70fba0794641beece737886cf92bc29622e464

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\pt-PT.pak

Filesize
123KB

MD5
b7598cb8f05f465909ddb0045d60162e

SHA1
b794c944dd5287e550a3e46bc9a0584d3d753eb1

SHA256
c338f6de946cca52c457d236037cf1c9f13b6c73796b713f390524f321b401d6

SHA512
a53e9d6af760c4aebd418de134ba23ebc27076b02082e9eb1afb1bb7ec93a45ea22a4961c49023d7ca8b2d3aa99462ec35180797982a481ae823ac19b4b96f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ro.pak

Filesize
126KB

MD5
1ab0cbe10cb7c3d5beadc7b04a881885

SHA1
eca1fe3842b4a1b070a0f9ba1a27fd3e6284ba80

SHA256
9a80b326b712debc0d6e9639b45352fed1c4a49ec37490b49b8506c636fd2947

SHA512
581e42422db7ead773990036ce49a5d2589f3af610604582a4820dcee1c37d2923fbace738a42cb8b87407915e1693bbca6a2234a0716c7c8d875ca30915289b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ru.pak

Filesize
201KB

MD5
d269143626296c69906523810139e9af

SHA1
43abe13a4837892644774bf06eb89cafec49ac95

SHA256
b1bd2d1cc678784ab73a691d4a3dc876be78eee0a30661ac2666a9b8ab864ecf

SHA512
76b0cc1841dba7d4b4175b0c10d6c36c7f3e8ea4ad0b4e4c091391e2754913cb6c02f0285b73372d604a395b23995998090a0c68b607b4106226b7ac67ceff23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\sk.pak

Filesize
131KB

MD5
3ee3730ba0f6894f2651e4e1be37a214

SHA1
3a3adb77fcb6d0514a221e6671d815a1cb7a2c35

SHA256
23c8d9722e0a2e22fbc8ae1bebb9cff456fe026c986a211565fa9398376e64af

SHA512
000928407693007645230ab593a6055e6005e6c2cb362057ce8a1915ad96030a03b134ee20e3197daac9920c69df188867d3c5a603a3e36c2eccb0bdcd549206

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\sl.pak

Filesize
124KB

MD5
c20064c5c0dae644ce4ccc0a2234c128

SHA1
a50411c1431ae1f4fac74a34f1716809a0623380

SHA256
576891a9a61b9cd50024e507e93d32476332977db8e29ef3d46427015d4d26e6

SHA512
04f979cfc813c6b1d3a5d9b3b306c415529a1fb72e415e2742ee25ccebf04bbe3abca91bd66aa3633a97a1383f3c4b915319b8d0b25c0ef6eb8c2e08312dc01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\sr.pak

Filesize
190KB

MD5
0cf9aea120b76672d2b5e30e928459c5

SHA1
0219aaa5d84847fe86762baa82b7b8b301239c9d

SHA256
b6aeb180462d8f312762a419b45c910929e2322d45bbf2b84b0871ccf7838945

SHA512
e79a0800571ab7b64602db4941b689231edb20d65a89272b7dcae53426b7811791df8f6ef174c83680a6adf931efc3d47f133b971254c139e8b04953b8a10979

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\sv.pak

Filesize
114KB

MD5
007d56b78104f7e245f7c84f07949f25

SHA1
8e3104a8c26f8418f44e19640d9babcd68a640c1

SHA256
e6c9329d7184190a0282f6440dcad5531f9656514a37b7dcb5a510ef17f3793c

SHA512
30c492d48aff33af8a0290cbe29864ff5c7d46dc50f5c4c6d5c96e6aa273926840b28b78958070e1534038e66c0142ab65153d32d28b56fb5dca28844370a946

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\sw.pak

Filesize
118KB

MD5
89c5dce32ff87d5fb2b8e815f7e4cbab

SHA1
ca3138ea6103a5ba39e35c53e980b44c9889d386

SHA256
ca8d57f632880f7b736ef7f8c5f35ddc867e50919b1f7d835bae76f823ebed13

SHA512
9e3ded0e33f9441f31e95317ac6a7a140ee5c63bea8b1bf8c03952804fb6783e61e7971d5cbe1c698d3c4067233b78bf37099054fcfe38b091829f5435e6d435

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\ta.pak

Filesize
300KB

MD5
3dcd0523ccad674f2e93de57ad0082fe

SHA1
fd4a28ee288a1f33ee7260ae80df93aae9718039

SHA256
72ef4527f01018c90c583e48f37d20bfa684012bc00cb9ab5ffa3e222b9c7f3a

SHA512
2ec95b89051b019e98e6a1852e5e89e1c985a10998af1cb2603e5766698a2880355d8e6b959e60e9edb84354e99d0286708027c39a8add816c172ad1efe35b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\te.pak

Filesize
279KB

MD5
1eccb7be373fc3144ada2df9e493cc07

SHA1
eef3e05afdf910671a046cf90291c17731bdb378

SHA256
bd0a936ab62ab6ab172a192b7c082b824706f6b3d88580a6b6be32809354fc2a

SHA512
ea30d14fb7c2ad54263e12eb8469e6b058afb30448900b55d944aa87e266d735f2a04d2f29303087f2d13f379483d681285182e6ad2bb25bf36e311828e2a08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\th.pak

Filesize
235KB

MD5
1a66feba0d44231b935d83a7f36a09a0

SHA1
3e674234b10350ebec218c904a9c90f3edd29711

SHA256
11fd04f3b33d09041d646d34e61fa15b96c12dbc62e229b64306356de6155cac

SHA512
b7617094a6d27670c0720dc5dade4a866ecdd68c45c1b9e6dfe1c3074dd1957bd7459210d111ef33727122666b24c2449cce9f3e903aae59dcbe438b38c8a021

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\tr.pak

Filesize
121KB

MD5
2bcae092530d06fba9b23492ac4a1d6a

SHA1
4114af7364210a4bcd10099911083de2abc25d40

SHA256
65105386d6b52445fdc7660648259b43a04849a05035d749858d9f64d4209836

SHA512
e87778246b98d87f2f29e2abb02290b829cdcb753fd9b184fec61b0523452e262527432b73a11eba86d547ffce2ce00b4180ae8367419e2174b825ed290345b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\uk.pak

Filesize
204KB

MD5
ba2462d8b3b975bb265bcce6a3410cf6

SHA1
3caba82b3e14350a33711db68d98e6d211ac9fe5

SHA256
1dc63c538f6b96cf4e70284c078a6e18f58f599db2a2ec594da23b244944c9cc

SHA512
a46441e2c97032928dfc19b178cd3261887b7076917a4fe829083151c8298703c3921001cd62c630b35504444f069973605b487c954623ce16682491fccb7d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\vi.pak

Filesize
144KB

MD5
806b7d282e74565b95264ebbe6794d48

SHA1
3aabe2d802283fb9b3ef43932c1b7638ef6a1053

SHA256
7b4bf97b78a07422359b709ea17d1d6aa038e12ec420cd0fc7dce4b313fe4af7

SHA512
7380b7a2b239932d1167f194f81a1c867983fe318a1e48d246470de0c94837edd6c0a641e06f888e36ff5041fc2a69d19cf1a46bef816d07fd3ecda42b84e524

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\zh-CN.pak

Filesize
105KB

MD5
c82a124cc6e87ad403a67007b9c1fdb0

SHA1
1d4f1c0a3cda7d4a75a0f4035bc6d2718102f09c

SHA256
f597245963ca7b42b2a7e5e80af5258972002fd4bcd3a21c875e4051df3eb1a9

SHA512
5e45df31658039144316299879b4f1de7eb157fb830d08e8d93d3ccc2e033b1f8e2f59d29e11785ac8346988d5ba2afc373c01bc4a58ba3cc4439d9aff1ada87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\locales\zh-TW.pak

Filesize
104KB

MD5
ad19e8ac7f2b5e5f67b9f5671299d19e

SHA1
4a6936a4971c2b9a414f40de3eb5dafe1b5b3e52

SHA256
e30d22153e0860246c8c37855a385471ad1e74e1eadf56476a1ea980f9204d86

SHA512
4f283deaad6ef0327baf7cdfef063293d27c1746431261553a6c7925832fe77c8017c6d11f36c5ec657ecd3b563099c9e35bd2cbe52c12ee734f4bef9bffe077

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\resources.pak

Filesize
4.8MB

MD5
2db0729cb0a452b13400e0ad97a46a8e

SHA1
2aaaa7e0e932e7b46958214cce81d60099cfc2a0

SHA256
af41c2d4484ee3b86b63bde75f150bf67f78a6257d91b397b6b15d47b041e177

SHA512
967bcac22315ecbe76c5a1cec4439523a92710791ea6112aedeb2d294419714e7aab5526f868898c6c2cb83886dc98c694dddd314766c2ae373f55f3529a65fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\resources\app.asar

Filesize
53.9MB

MD5
8efa5dd5904bd2b20353352387646cfa

SHA1
bac616c13a75f6b64afc546984c4dacead3b5040

SHA256
137ffdc1f18c632b6d9dedf8fa5ccab4c84b304f986891dcbcab1b6722f45211

SHA512
ff7b16654db4ea16c8252ecb41413a3f1ec54672d2bb4e99a791bfa96bd14bb0cd636da70db922ed4e85693c09bebbec4991fc71d6254988f0ef89fb32b6836f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest

Filesize
350B

MD5
8951565428aa6644f1505edb592ab38f

SHA1
9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

SHA256
8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

SHA512
7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js

Filesize
3KB

MD5
d226502c9bf2ae0a7f029bd7930be88e

SHA1
6be773fb30c7693b338f7c911b253e4f430c2f9b

SHA256
77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f

SHA512
93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat

Filesize
13KB

MD5
da0f40d84d72ae3e9324ad9a040a2e58

SHA1
4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

SHA256
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

SHA512
30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\snapshot_blob.bin

Filesize
342KB

MD5
19f1e25cc7c427dbfb519ce6dc2c7e64

SHA1
5578aa048412482650bb51b04ccbf038155f5c8b

SHA256
b6531c8ff3a288d00e4625cfc5019ccdac9cb8a53e723792616aace3b27f90c3

SHA512
ef07c82a8a3f36bc8492d0c0a964ee57c3bae3188c7c67eb555b9d117739b5a09e44183dbf9f2cf17ac386d7d777b62b534b2f55edec977c75ec3d6b5b535620

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\swiftshader\libEGL.dll

Filesize
450KB

MD5
2ffc36c5555a36a4f26c1aa7a8108b4a

SHA1
2ec38b17a0e9d5b0a4c397921aa4430607d32edc

SHA256
f8b8b96cc384171268cbd543d9486a97b2f2066d45ac118421ff974baf18d2e5

SHA512
0df87d336e223ade77eecaee88d8af2832f1cec3b5681699646e0be933b3f0acdb3765492e9d8fd713453dea2a7fd38d46c201c96313a06a484f23a78a716cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\swiftshader\libGLESv2.dll

Filesize
3.0MB

MD5
41d3387761bbb79d4820e8d242561027

SHA1
27dfda8ce933af12578fb64f3171f40f56bace55

SHA256
ed005ae1d388e0256e9ae304933980897ec2cfa957ed5babab6ae2a5dcf5c5f5

SHA512
cc396d0c2a94c31b8a42697f456f74e8ede1ad1fbc7eb1e4983544166041ff878048f60af9b1525320770ee477c63d6c466746c2c33fd30bc2d7ec903f8af944

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\v8_context_snapshot.bin

Filesize
656KB

MD5
c384ae622a7a6c7ec328678af12922c2

SHA1
25165dcaf78d3d29a16e4f979370e0b009ede240

SHA256
977a027c50bd79e93ec015fbebaccfaaa8885b88c76f7e5a2c33337d6d5173c3

SHA512
d0571f5e18dcf14a591a76243d52094bb843b0779630f31cbb66fd738c1c35d10bb7ef751eb01a953305ee19f2777f4d3ca6f9b132199b2af357c0b03185d9a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\vk_swiftshader.dll

Filesize
4.4MB

MD5
37bba2c66e2364a5b3e6666864f3b604

SHA1
f2ecffd48760482ba055aa50cd78c5ac02d09ba2

SHA256
23e6927733549be11d506b862cc7148b7b08b50b4387837db522ec9380babc46

SHA512
6e7835fce0e988c997049796125b4f2ef83cb9c2e326edeb54d4bad77fa31bf4b4227aeb1db445d3ee21e6cb959d65310a1bbda2d14e567d4123cf6544a947ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\7z-out\vulkan-1.dll

Filesize
819KB

MD5
ad4a5dcf631afd553b4fed8a269c7897

SHA1
f1bded0b28ee8aed4a52a6d19d871eba4828e0f2

SHA256
3141825bfa3a8cecf8b59767e8b6ac41c20685932d6000b9c6cd0e40ddca12db

SHA512
8e01379201f2a907cff7f32dfbac6b1eb8ee014312755884b35e4065477d8a8069e3188086d7cced11d437b461211bca6abb6e582e98473883cf35faad41eae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\screenCapture\CSC75B23E5B3C8248448975F3F5B8FCAB0.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
C:\Users\Admin\AppData\Roaming\EpsilonFruit\Local Storage\leveldb\CURRENT~RFf76312e.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
\Users\Admin\AppData\Local\Temp\1e7eb5ec-0d43-4229-be4a-8b0a55b62afc.tmp.node

Filesize
2.7MB

MD5
08b28072c6d59fdf06a808182efed01f

SHA1
35253af00af3308a64cff1eda104fd7227abb2f4

SHA256
7c999c84852b1f46a48f75b130fea445280d7032a56359dffecf36730366abc5

SHA512
f2592ade5053b674dbe4191c7001748a801dca3b19e97e19b440a3e944011c87926b0ef21c87e98b48e038889a32e01c1d74949124be3144834e2f06d9781198

Download Submit
\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
52.4MB

MD5
0204ab8584b86f237364e80a51790c67

SHA1
e921f70eedb43ba053565351ee3fc661622e5e35

SHA256
48894faad86a265173bb82c5e94858eb872cc7c6fd5f79991c8ba5ccd9819094

SHA512
451f8bf97b709f118d72c8e2e2ccc4c0b68ee9fe26a530936876aa367b3dee86be1bfb5f0202ea9fab2ec7caffb5d9d75cf9718f578c76d339e27e459b9a4ef1

Download Submit
\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
48.2MB

MD5
2b7c7db5fe85dfcb721514568159200d

SHA1
e59f509b14477d176e598d372e0ea5bb4d4690d8

SHA256
4cbf0be23ea108d065c67ce81c5ecc9fb8290d729c3b1c72420af7834e7ddf8a

SHA512
c87bed242aca12a7d0a83eeff9dc7bacb8ee3125cd42a4ebf36a5e65dc61f7d447a6a91568debb41e295c3316b62f06c9f396631f77fefa4378bc21756abe787

Download Submit
\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
46.9MB

MD5
d62e0240cf66141f6f15f9ea00da2ef1

SHA1
42e454ebf1f2e6cad679c951be07fc27d980ba78

SHA256
148f31c44571de0bb707c80c5a2071d40a1954d7a5655a879313b4cdc8467f0b

SHA512
a19ed167be3fd790897f2dfe1f91f7d712555c49e8e5be55b7c511366aeb65d02e144a0b19a0b6e73456e196e2a3aa10f6ad8c078b15e7b4022060e92982fb76

Download Submit
\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
44.6MB

MD5
c697e185c2c83b02614373a47f51632f

SHA1
cefd8dffedd54074566c5bc6a40a434bcc62f181

SHA256
fd95b077a69535be72f5c92b63ee71a44f2c172706bd9dc557a612c19c128aa3

SHA512
f6789050a7d9388290321a4be757de69795a45780c2df02fdeef7b12b01a4690c0ca5792094ca7c64ecdd56d07a86df3609277c25ae1783ab59843c770e0c337

Download Submit
\Users\Admin\AppData\Local\Temp\2f39P0ISFknOZLiL2q9ButG5J7V\EpsilonFruit.exe

Filesize
42.6MB

MD5
c89e76165e0ec74f49ad39a5882b516b

SHA1
9d85b6ba9a572dc0582e88c022549a4174e6de2b

SHA256
718113bc680dadaaadcbe14326b3f7cffe55556000840d74dd9539ab064db68a

SHA512
dd3c8276e0ee8fb3b3f3f548c360ed40db35a578c95ae661b38fdd7fbc526179445e518a406bb709623068d7d2e71d19cdb84942d288998b5752cf5e62e5c366

Download Submit
\Users\Admin\AppData\Local\Temp\65b61630-cf48-483a-a369-696b7179d86e.tmp.node

Filesize
652KB

MD5
1f86d23226fffe71b8784029d8c5125b

SHA1
9cc9bc5a5ca25a682746480dff1677d0ff5ec16c

SHA256
265d11dea86267a478907b398b8b33aad69f0944784386c1795cc32b8c931ffd

SHA512
4f1aaee14c9cb0a76853a15030b525ee082a226ac67e9c90a96bbdbbb9229f6fe48192d63686f72c55e094de45c2a032bdd241fcacc190b71ffdc0fde80824ae

Download Submit
\Users\Admin\AppData\Local\Temp\81e10dc4-411f-42e0-a7b2-52738892edee.tmp.node

Filesize
163KB

MD5
b0e113443ddc1ee234acbf0eb0e6f8a0

SHA1
84cc562b82570ec05df6dbbfc8f29fbb16ec68c7

SHA256
8d6f5cab1d6a99ac49772080c6f383f33a9bb983e0f8d02d0f3de4b2bdd26215

SHA512
306e89ec66fdf8b0de19d5bcda01f69809d83f464a9c21fda4b470e81ad3b722aa6cb6086fb4c2af59504fe4332c1f9efff27168598cc00be0f28fed45dde8ee

Download Submit
\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy13A1.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/284-1091-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/284-1007-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/472-906-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/808-980-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/872-1082-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/904-1045-0x0000000000980000-0x000000000098A000-memory.dmp

Filesize
40KB

Download
memory/904-1051-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1248-1046-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1248-966-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

Filesize
40KB

Download
memory/1248-969-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1420-1061-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1420-987-0x0000000000E10000-0x0000000000E1A000-memory.dmp

Filesize
40KB

Download
memory/1420-994-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1588-1065-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1588-1060-0x00000000012A0000-0x00000000012AA000-memory.dmp

Filesize
40KB

Download
memory/1636-957-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/1636-953-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/1636-952-0x0000000000800000-0x000000000080A000-memory.dmp

Filesize
40KB

Download
memory/1752-1029-0x00000000000A0000-0x00000000000AA000-memory.dmp

Filesize
40KB

Download
memory/1752-1030-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1752-1033-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1812-905-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/1820-903-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/1836-597-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2120-907-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2164-904-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2164-887-0x00000000010C0000-0x00000000010CA000-memory.dmp

Filesize
40KB

Download
memory/2220-574-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2220-641-0x00000000773D0000-0x00000000773D1000-memory.dmp

Filesize
4KB

Download
memory/2232-1074-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2240-930-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2240-927-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2268-1041-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2268-1038-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2268-1037-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/2356-1095-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2356-1023-0x00000000012E0000-0x00000000012EA000-memory.dmp

Filesize
40KB

Download
memory/2356-1026-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2384-1011-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2384-1010-0x00000000010E0000-0x00000000010EA000-memory.dmp

Filesize
40KB

Download
memory/2384-1081-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2408-937-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2408-940-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2488-919-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2488-988-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2504-979-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2504-888-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2544-1006-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2544-925-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2572-944-0x0000000000280000-0x000000000028A000-memory.dmp

Filesize
40KB

Download
memory/2572-948-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2572-945-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-1100-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-1099-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2672-908-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2740-995-0x0000000000140000-0x000000000014A000-memory.dmp

Filesize
40KB

Download
memory/2740-996-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2740-999-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2760-1069-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2900-933-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2900-1018-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/2904-1096-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/2968-1019-0x000007FEF30C0000-0x000007FEF3AAC000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1057-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1054-0x000007FEF26D0000-0x000007FEF30BC000-memory.dmp

Filesize
9.9MB

Download
memory/3004-1053-0x0000000000E50000-0x0000000000E5A000-memory.dmp

Filesize
40KB

Download