ca4bd34795e2ca0c3d1620e85b1019d3cec99785ffe6c4712be0fc1a812305fc

Analysis

max time kernel
41s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Size 957KB
Sample240403-whxlfagf74
SHA256 ca4bd34795e2ca0c3d1620e85b1019d3cec99785ffe6c4712be0fc1a812305fc
MD5 a2b3cb3afb3219dbd1d94594bb208e20
SHA1 55cfee7e224acd776788a5824b9e0e2b5a14b95a
SHA512 063a79a83c82e6d1f46827a753ed5e6585f0d24b8eb55ab3a9e2ea50bec36164cda0811dca707d820493d6df43646964c37bd78ba7e83542354dc13a8472b851
SSDEEP 12288:8uPUTLYcAaUMhUhLupXshh1PEd5hOo3fzhai6L3k8UW/M1QwXGB/I:8uPmLDUMihIXCE5Bfsi6rk76MRXGBg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Isass.exe

Executes dropped EXE 47 IoCs

pid	Process
208	Isass.exe
4412	Isass.exe
2112	Isass.exe
4028	Isass.exe
1428	Isass.exe
2836	Isass.exe
1060	Isass.exe
4500	Isass.exe
3240	Isass.exe
3756	Isass.exe
3412	Isass.exe
2056	Isass.exe
2768	Isass.exe
2244	Isass.exe
2524	Isass.exe
4008	Isass.exe
4072	Isass.exe
4488	Isass.exe
3100	Isass.exe
4644	Isass.exe
3048	Isass.exe
840	Isass.exe
4856	Isass.exe
2784	Isass.exe
3320	Isass.exe
4656	Isass.exe
876	Isass.exe
3328	Isass.exe
4068	Isass.exe
4172	Isass.exe
2408	Isass.exe
4448	Isass.exe
2520	Isass.exe
5080	Isass.exe
64	Isass.exe
4588	Isass.exe
4156	Isass.exe
4868	Isass.exe
3824	Isass.exe
2500	Isass.exe
1512	Isass.exe
2236	Isass.exe
1684	Isass.exe
4856	Isass.exe
3320	Isass.exe
4008	Isass.exe
4588	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
208	Isass.exe
208	Isass.exe
4412	Isass.exe
4412	Isass.exe
4412	Isass.exe
4412	Isass.exe
4412	Isass.exe
4412	Isass.exe
376	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
376	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
2112	Isass.exe
2112	Isass.exe
2112	Isass.exe
2112	Isass.exe
2112	Isass.exe
2112	Isass.exe
4324	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
4324	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
4028	Isass.exe
4028	Isass.exe
4028	Isass.exe
4028	Isass.exe
4028	Isass.exe
4028	Isass.exe
4364	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
4364	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
1428	Isass.exe
1428	Isass.exe
1428	Isass.exe
1428	Isass.exe
1428	Isass.exe
1428	Isass.exe
520	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
520	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
2836	Isass.exe
2836	Isass.exe
2836	Isass.exe
2836	Isass.exe
2836	Isass.exe
2836	Isass.exe
2964	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
2964	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
1060	Isass.exe
1060	Isass.exe
1060	Isass.exe
1060	Isass.exe
1060	Isass.exe
1060	Isass.exe
3132	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
3132	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
4500	Isass.exe
4500	Isass.exe
4500	Isass.exe
4500	Isass.exe
4500	Isass.exe
4500	Isass.exe
4800	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
4800	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
3240	Isass.exe
3240	Isass.exe
3240	Isass.exe
3240	Isass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 208	2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	86
PID 2988 wrote to memory of 208	2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	86
PID 2988 wrote to memory of 208	2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	86
PID 2988 wrote to memory of 4412	2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	89
PID 2988 wrote to memory of 4412	2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	89
PID 2988 wrote to memory of 4412	2988	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	89
PID 4412 wrote to memory of 376	4412	Isass.exe	90
PID 4412 wrote to memory of 376	4412	Isass.exe	90
PID 4412 wrote to memory of 376	4412	Isass.exe	90
PID 376 wrote to memory of 2112	376	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	91
PID 376 wrote to memory of 2112	376	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	91
PID 376 wrote to memory of 2112	376	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	91
PID 2112 wrote to memory of 4324	2112	Isass.exe	92
PID 2112 wrote to memory of 4324	2112	Isass.exe	92
PID 2112 wrote to memory of 4324	2112	Isass.exe	92
PID 4324 wrote to memory of 4028	4324	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	186
PID 4324 wrote to memory of 4028	4324	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	186
PID 4324 wrote to memory of 4028	4324	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	186
PID 4028 wrote to memory of 4364	4028	Isass.exe	94
PID 4028 wrote to memory of 4364	4028	Isass.exe	94
PID 4028 wrote to memory of 4364	4028	Isass.exe	94
PID 4364 wrote to memory of 1428	4364	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	230
PID 4364 wrote to memory of 1428	4364	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	230
PID 4364 wrote to memory of 1428	4364	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	230
PID 1428 wrote to memory of 520	1428	Isass.exe	96
PID 1428 wrote to memory of 520	1428	Isass.exe	96
PID 1428 wrote to memory of 520	1428	Isass.exe	96
PID 520 wrote to memory of 2836	520	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	97
PID 520 wrote to memory of 2836	520	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	97
PID 520 wrote to memory of 2836	520	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	97
PID 2836 wrote to memory of 2964	2836	Isass.exe	258
PID 2836 wrote to memory of 2964	2836	Isass.exe	258
PID 2836 wrote to memory of 2964	2836	Isass.exe	258
PID 2964 wrote to memory of 1060	2964	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	211
PID 2964 wrote to memory of 1060	2964	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	211
PID 2964 wrote to memory of 1060	2964	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	211
PID 1060 wrote to memory of 3132	1060	Isass.exe	100
PID 1060 wrote to memory of 3132	1060	Isass.exe	100
PID 1060 wrote to memory of 3132	1060	Isass.exe	100
PID 3132 wrote to memory of 4500	3132	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	101
PID 3132 wrote to memory of 4500	3132	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	101
PID 3132 wrote to memory of 4500	3132	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	101
PID 4500 wrote to memory of 4800	4500	Isass.exe	102
PID 4500 wrote to memory of 4800	4500	Isass.exe	102
PID 4500 wrote to memory of 4800	4500	Isass.exe	102
PID 4800 wrote to memory of 3240	4800	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	103
PID 4800 wrote to memory of 3240	4800	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	103
PID 4800 wrote to memory of 3240	4800	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	103
PID 3240 wrote to memory of 4580	3240	Isass.exe	152
PID 3240 wrote to memory of 4580	3240	Isass.exe	152
PID 3240 wrote to memory of 4580	3240	Isass.exe	152
PID 4580 wrote to memory of 3756	4580	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	105
PID 4580 wrote to memory of 3756	4580	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	105
PID 4580 wrote to memory of 3756	4580	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	105
PID 3756 wrote to memory of 4292	3756	Isass.exe	106
PID 3756 wrote to memory of 4292	3756	Isass.exe	106
PID 3756 wrote to memory of 4292	3756	Isass.exe	106
PID 4292 wrote to memory of 3412	4292	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	107
PID 4292 wrote to memory of 3412	4292	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	107
PID 4292 wrote to memory of 3412	4292	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	107
PID 3412 wrote to memory of 3340	3412	Isass.exe	108
PID 3412 wrote to memory of 3340	3412	Isass.exe	108
PID 3412 wrote to memory of 3340	3412	Isass.exe	108
PID 3340 wrote to memory of 2056	3340	a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe	111

C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        5⤵
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:520
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        11⤵
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        13⤵
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        17⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        19⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        23⤵
        Checks computer location settings
        
        PID:2116
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        25⤵
        Checks computer location settings
        
        PID:2344
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        26⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        27⤵
        Checks computer location settings
        
        PID:3116
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        28⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        29⤵
        
        PID:2656
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        30⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        31⤵
        
        PID:2176
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        32⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        33⤵
        Checks computer location settings
        
        PID:3124
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        34⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        35⤵
        
        PID:4312
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        36⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        37⤵
        Checks computer location settings
        
        PID:2992
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        38⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        39⤵
        
        PID:4168
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        40⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        41⤵
        
        PID:2712
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        42⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        43⤵
        Checks computer location settings
        
        PID:4764
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        44⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        45⤵
        Checks computer location settings
        
        PID:488
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        46⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        47⤵
        Checks computer location settings
        
        PID:2244
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        48⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        49⤵
        Checks computer location settings
        
        PID:316
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        50⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        51⤵
        
        PID:3256
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        52⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        53⤵
        Checks computer location settings
        
        PID:2708
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        54⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        55⤵
        Checks computer location settings
        
        PID:1184
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        56⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        57⤵
        Checks computer location settings
        
        PID:4580
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        58⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        59⤵
        
        PID:4716
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        60⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        61⤵
        Checks computer location settings
        
        PID:3044
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        62⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        63⤵
        Checks computer location settings
        
        PID:1780
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        64⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        65⤵
        Checks computer location settings
        
        PID:4884
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        66⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        67⤵
        
        PID:3868
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        68⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        69⤵
        Checks computer location settings
        
        PID:2284
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        70⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        71⤵
        Checks computer location settings
        
        PID:3332
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        72⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        73⤵
        Checks computer location settings
        
        PID:2708
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        74⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        75⤵
        
        PID:4560
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        76⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        77⤵
        Checks computer location settings
        
        PID:2752
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        78⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        79⤵
        Checks computer location settings
        
        PID:4716
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        80⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        81⤵
        Checks computer location settings
        
        PID:4288
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        82⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        83⤵
        Checks computer location settings
        
        PID:3348
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        84⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        85⤵
        
        PID:2252
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        86⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        87⤵
        Checks computer location settings
        
        PID:5024
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        88⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        89⤵
        Checks computer location settings
        
        PID:2992
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        90⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        91⤵
        Checks computer location settings
        
        PID:4028
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        92⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        93⤵
        
        PID:2896
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        94⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        95⤵
        
        PID:2256
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        96⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        97⤵
        
        PID:1984
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        98⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        99⤵
        
        PID:2712
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        100⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        101⤵
        
        PID:3188
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        102⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        103⤵
        
        PID:4448
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        104⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        105⤵
        
        PID:3148
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        106⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        107⤵
        
        PID:4884
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        108⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        109⤵
        
        PID:4956
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        110⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        111⤵
        
        PID:2176
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        112⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        113⤵
        
        PID:4012
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        114⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        115⤵
        
        PID:3564
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        116⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        117⤵
        
        PID:1348
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        118⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        119⤵
        
        PID:4992
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        120⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        121⤵
        
        PID:3176
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        122⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        123⤵
        
        PID:4120
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        124⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        125⤵
        
        PID:2552
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        126⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        127⤵
        
        PID:3528
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        128⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        129⤵
        
        PID:3224
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        130⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        131⤵
        
        PID:4884
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        132⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        133⤵
        
        PID:4680
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        134⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        135⤵
        
        PID:1428
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        136⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        137⤵
        
        PID:4568
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        138⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        139⤵
        
        PID:1200
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        140⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        141⤵
        
        PID:2256
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        142⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        143⤵
        
        PID:5016
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        144⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        145⤵
        
        PID:3752
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        146⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        147⤵
        
        PID:3676
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        148⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        149⤵
        
        PID:1752
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        150⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        151⤵
        
        PID:840
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        152⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        153⤵
        
        PID:5112
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        154⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        155⤵
        
        PID:1036
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        156⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        157⤵
        
        PID:4676
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        158⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        159⤵
        
        PID:2416
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        160⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        161⤵
        
        PID:1428
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        162⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        163⤵
        
        PID:2964
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        164⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        165⤵
        
        PID:4860
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        166⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        167⤵
        
        PID:4464
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        168⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        169⤵
        
        PID:3948
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        170⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        171⤵
        
        PID:4888
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        172⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        173⤵
        
        PID:4620
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        174⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        175⤵
        
        PID:4496
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        176⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        177⤵
        
        PID:3676
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        178⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        179⤵
        
        PID:2668
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        180⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        181⤵
        
        PID:1068
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        182⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        183⤵
        
        PID:2832
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        184⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        185⤵
        
        PID:3720
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        186⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        187⤵
        
        PID:4884
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        188⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        189⤵
        
        PID:2656
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        190⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        191⤵
        
        PID:2224
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        192⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        193⤵
        
        PID:3328
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        194⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        195⤵
        
        PID:4188
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        196⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        197⤵
        
        PID:3824
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        198⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        199⤵
        
        PID:4480
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        200⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        201⤵
        
        PID:2056
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        202⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        203⤵
        
        PID:4576
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        204⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        205⤵
        
        PID:3188
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        206⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        207⤵
        
        PID:5108
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        208⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        209⤵
        
        PID:2668
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        210⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        211⤵
        
        PID:5112
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        212⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        213⤵
        
        PID:5024
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        214⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        215⤵
        
        PID:3720
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        216⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        217⤵
        
        PID:5096
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        218⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        219⤵
        
        PID:2416
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        220⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        221⤵
        
        PID:3836
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        222⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        223⤵
        
        PID:3020
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        224⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        225⤵
        
        PID:2276
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        226⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        227⤵
        
        PID:4132
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        228⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        229⤵
        
        PID:1984
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        230⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        231⤵
        
        PID:2536
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        232⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        233⤵
        
        PID:2260
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        234⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        235⤵
        
        PID:3820
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        236⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        237⤵
        
        PID:3432
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        238⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        239⤵
        
        PID:2252
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        240⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        241⤵
        
        PID:840
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        242⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        243⤵
        
        PID:3272
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        244⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        245⤵
        
        PID:2244
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        246⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        247⤵
        
        PID:4960
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        248⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        249⤵
        
        PID:2176
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        250⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        251⤵
        
        PID:4752
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        252⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        253⤵
        
        PID:868
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        254⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        255⤵
        
        PID:544
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        256⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        257⤵
        
        PID:4468
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        258⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        259⤵
        
        PID:764
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        260⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        261⤵
        
        PID:436
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        262⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        263⤵
        
        PID:2256
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        264⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        265⤵
        
        PID:4716
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        266⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        267⤵
        
        PID:692
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        268⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        269⤵
        
        PID:2908
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        270⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        271⤵
        
        PID:1684
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        272⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        273⤵
        
        PID:2840
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        274⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        275⤵
        
        PID:2520
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        276⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        277⤵
        
        PID:3044
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        278⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        279⤵
        
        PID:1740
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        280⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        281⤵
        
        PID:2184
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        282⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        283⤵
        
        PID:1564
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        284⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        285⤵
        
        PID:4752
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        286⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        287⤵
        
        PID:3852
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        288⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        289⤵
        
        PID:4972
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        290⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        291⤵
        
        PID:2264
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        292⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        293⤵
        
        PID:312
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        294⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        295⤵
        
        PID:4132
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        296⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        297⤵
        
        PID:1336
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        298⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        299⤵
        
        PID:4944
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        300⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        301⤵
        
        PID:5056
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        302⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        303⤵
        
        PID:4080
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        304⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        305⤵
        
        PID:3644
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        306⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        307⤵
        
        PID:4068
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        308⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        309⤵
        
        PID:4552
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        310⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        311⤵
        
        PID:4492
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        312⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        313⤵
        
        PID:4956
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        314⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        315⤵
        
        PID:2496
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        316⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        317⤵
        
        PID:2992
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        318⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        319⤵
        
        PID:520
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        320⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        321⤵
        
        PID:2608
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        322⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        323⤵
        
        PID:5020
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        324⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        325⤵
        
        PID:4268
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        326⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        327⤵
        
        PID:4796
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        328⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        329⤵
        
        PID:1220
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        330⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        331⤵
        
        PID:724
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        332⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        333⤵
        
        PID:2268
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        334⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        335⤵
        
        PID:1460
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        336⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        337⤵
        
        PID:2552
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        338⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        339⤵
        
        PID:4776
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        340⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        341⤵
        
        PID:216
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        342⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        343⤵
        
        PID:4564
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        344⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        345⤵
        
        PID:4852
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        346⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        347⤵
        
        PID:4440
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        348⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe"
        349⤵
        
        PID:4256
        
        C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a2b3cb3afb3219dbd1d94594bb208e20_JaffaCakes118.exe
        350⤵
        
        PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Isass.exe

Path C:\Users\Public\Microsoft Build\Isass.exe
Size 624KB
SHA256 729a2cde6913456b277cb3ee696b7e59bffbf53fffd872388b636d3f3d3088b4
MD5 e5960f5e47cfc418a675d5e63f407baf
SHA1 a24bf709f785026276df17dc7c23978fe69bf648
SHA512 56c9b3de1f07b9ffba957afffd9bec8f3b267ae54b55967bb9256447088a864b6b823210376265f8cc7bf360a6d89c3a5bc67d88bc928c06638266ea73b1fa4b
SSDEEP 6144:n8fgjPU6UL0rcAyt8eeMfzghoaGZhGp7A+upa9mv7Ih/hewA+B/uhXd5rvlnOoNp:8uPUTLYcAaUMhUhLupXshh1PEd5hOoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.7MB
SHA256 ae9ac0d234a6b65e1acb769231c95f2dd6340ca9238bb38c543272e32179233e
MD5 66d13ce535674d4cba61f2f1ca1d5177
SHA1 4764271b3376e2e1350e0ff77fc18c0eac1a2989
SHA512 41e0538f1d8744eba776e7fa46e75ffb98ca00f3b793e8391a765c03d64a0dcf8db5065b678919ceaae01bb90c0788c8c5dd7ea074b0652a68034b927fa72916
SSDEEP 98304:8ugIIrx4iuSl1DtlEq81xZPGnzURnBh6gGS/QmvD/cTwY2h3F+TSNmfsN3gQxRiM:spTXexZPGzURnBh6gGSF+W3UTlsN3gQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-93-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/208-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/208-28-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/208-152-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/208-31-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/316-134-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/316-132-0x0000000003710000-0x0000000003711000-memory.dmp

Download

memory/376-10-0x0000000001B70000-0x0000000001B71000-memory.dmp

Download

memory/376-12-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/488-122-0x0000000001B50000-0x0000000001B51000-memory.dmp

Download

memory/488-124-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/520-25-0x0000000001A00000-0x0000000001A01000-memory.dmp

Download

memory/520-27-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/840-116-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/840-115-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/876-141-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/876-140-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/1060-35-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/1060-36-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/1184-149-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/1184-147-0x0000000001B60000-0x0000000001B61000-memory.dmp

Download

memory/1428-24-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/1428-23-0x0000000001F60000-0x0000000001F61000-memory.dmp

Download

memory/1780-168-0x0000000001F70000-0x0000000001F71000-memory.dmp

Download

memory/2056-61-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2056-60-0x0000000003A10000-0x0000000003A11000-memory.dmp

Download

memory/2112-14-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2112-13-0x0000000001E80000-0x0000000001E81000-memory.dmp

Download

memory/2116-64-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2116-62-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/2176-81-0x0000000001E60000-0x0000000001E61000-memory.dmp

Download

memory/2176-83-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2244-129-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2244-69-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/2244-70-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2244-127-0x0000000001B20000-0x0000000001B21000-memory.dmp

Download

memory/2344-68-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2408-161-0x0000000001B30000-0x0000000001B31000-memory.dmp

Download

memory/2408-162-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2524-74-0x0000000001B80000-0x0000000001B81000-memory.dmp

Download

memory/2524-75-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2656-76-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/2656-78-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2708-142-0x0000000001A80000-0x0000000001A81000-memory.dmp

Download

memory/2708-144-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2712-112-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/2712-114-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2768-65-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/2768-66-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2784-126-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2784-125-0x0000000003620000-0x0000000003621000-memory.dmp

Download

memory/2836-29-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/2836-30-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2964-34-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2964-32-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/2988-7-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2988-0-0x00000000019D0000-0x00000000019D1000-memory.dmp

Download

memory/2992-104-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/2992-102-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/3044-165-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3044-163-0x0000000001A00000-0x0000000001A01000-memory.dmp

Download

memory/3048-111-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3048-110-0x0000000001F60000-0x0000000001F61000-memory.dmp

Download

memory/3100-100-0x0000000001C40000-0x0000000001C41000-memory.dmp

Download

memory/3100-101-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3116-71-0x0000000001B80000-0x0000000001B81000-memory.dmp

Download

memory/3116-73-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3124-86-0x0000000003800000-0x0000000003801000-memory.dmp

Download

memory/3124-88-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3132-39-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3132-37-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/3240-45-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/3240-46-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3256-139-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3256-137-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/3320-130-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/3320-131-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3328-145-0x0000000001C50000-0x0000000001C51000-memory.dmp

Download

memory/3328-146-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3340-59-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3340-57-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/3412-55-0x0000000001B80000-0x0000000001B81000-memory.dmp

Download

memory/3412-56-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3756-51-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/3756-50-0x0000000003710000-0x0000000003711000-memory.dmp

Download

memory/4008-80-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4008-79-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/4028-19-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4028-18-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/4068-150-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/4068-151-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4072-85-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4072-84-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/4168-107-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4168-109-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4172-156-0x0000000001A80000-0x0000000001A81000-memory.dmp

Download

memory/4172-157-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4292-54-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4292-52-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/4312-97-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/4312-99-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4324-17-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4324-15-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/4364-20-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4364-22-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4412-9-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4412-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4448-166-0x0000000003810000-0x0000000003811000-memory.dmp

Download

memory/4488-89-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4488-92-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4500-41-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4500-40-0x0000000001B30000-0x0000000001B31000-memory.dmp

Download

memory/4580-47-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/4580-49-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4580-153-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/4580-155-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4644-105-0x00000000022F0000-0x00000000022F1000-memory.dmp

Download

memory/4644-106-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4656-136-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4656-135-0x0000000001A60000-0x0000000001A61000-memory.dmp

Download

memory/4716-158-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/4716-160-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4764-117-0x0000000001A00000-0x0000000001A01000-memory.dmp

Download

memory/4764-119-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4800-44-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4800-42-0x0000000003B20000-0x0000000003B21000-memory.dmp

Download

memory/4856-121-0x0000000000400000-0x00000000016A3000-memory.dmp

Download

memory/4856-120-0x0000000003810000-0x0000000003811000-memory.dmp

Download