Malware Analysis Report

2024-08-06 15:24

Sample ID 240519-ct9wcsdf3y
Target 58174d87903175d3435b0797c5cbca72_JaffaCakes118
SHA256 2437c4e083c09345250b2311dcbfad2fe82621af546731d0f42daabbe39388c3
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2437c4e083c09345250b2311dcbfad2fe82621af546731d0f42daabbe39388c3

Threat Level: Known bad

The file 58174d87903175d3435b0797c5cbca72_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-19 02:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 02:23

Reported

2024-05-19 02:25

Platform

win7-20240508-en

Max time kernel

132s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2132 set thread context of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 set thread context of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1828 set thread context of 1852 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2436 set thread context of 2820 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2280 set thread context of 1092 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2736 set thread context of 1524 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1632 set thread context of 3044 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1236 set thread context of 2080 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2004 set thread context of 2628 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2640 set thread context of 1708 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1508 set thread context of 2896 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1076 set thread context of 1828 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1124 set thread context of 3016 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 292 set thread context of 2884 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 set thread context of 2216 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2872 set thread context of 2572 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 376 set thread context of 2764 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 set thread context of 1260 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2060 set thread context of 2944 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1984 set thread context of 1996 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1508 set thread context of 1312 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2888 set thread context of 2312 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1636 set thread context of 884 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1224 set thread context of 1720 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2760 set thread context of 1728 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2556 set thread context of 2228 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 760 set thread context of 952 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1252 set thread context of 1776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 set thread context of 688 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1508 set thread context of 1524 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 336 set thread context of 1976 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 set thread context of 1760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1860 set thread context of 2300 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2628 set thread context of 1092 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1984 set thread context of 1184 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2472 set thread context of 2740 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2980 set thread context of 2440 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 812 set thread context of 2984 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 844 set thread context of 2904 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 set thread context of 2020 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1528 set thread context of 2604 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2316 set thread context of 1644 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1244 set thread context of 1496 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2704 set thread context of 2972 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3032 set thread context of 1580 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2592 set thread context of 656 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2164 set thread context of 1476 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1308 set thread context of 3016 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 684 set thread context of 1720 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 344 set thread context of 376 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3060 set thread context of 3020 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 set thread context of 2784 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1336 set thread context of 1676 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1316 set thread context of 1860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2420 set thread context of 2068 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2404 set thread context of 2708 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1300 set thread context of 2684 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1356 set thread context of 2184 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2300 set thread context of 2968 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1768 set thread context of 300 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 628 set thread context of 1968 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 752 set thread context of 2976 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1616 set thread context of 2816 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2088 set thread context of 572 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\ARP Host\arphost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2132 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2836 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2836 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2836 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2836 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2132 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2132 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2132 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2132 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2840 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2840 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2840 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2840 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2296 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2296 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2296 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2296 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2840 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2840 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2840 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 1828 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1828 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1828 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jmltmjot\jmltmjot.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2108.tmp" "c:\Users\Admin\AppData\Local\Temp\jmltmjot\CSCC703CA0A8B624A2092B4A27A81AEE23.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rtqk1qrv\rtqk1qrv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23F5.tmp" "c:\Users\Admin\AppData\Local\Temp\rtqk1qrv\CSCED9F6F2B9F74892BF7E26EC16C4BF13.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rbvin2x0\rbvin2x0.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES278D.tmp" "c:\Users\Admin\AppData\Local\Temp\rbvin2x0\CSC15B017D68F814E2490D699749436FFA0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y1btixp5\y1btixp5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2AE7.tmp" "c:\Users\Admin\AppData\Local\Temp\y1btixp5\CSCB3741DE0835245508EA264C16538199.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bufnzue\2bufnzue.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D76.tmp" "c:\Users\Admin\AppData\Local\Temp\2bufnzue\CSC73882813913A422392EBE1548DAAC543.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\to0zmow3\to0zmow3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FF6.tmp" "c:\Users\Admin\AppData\Local\Temp\to0zmow3\CSC48944E81E51A4BEF9D817CB1905730F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tdtvn2ph\tdtvn2ph.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32B4.tmp" "c:\Users\Admin\AppData\Local\Temp\tdtvn2ph\CSCE4707B00C65F436B83EF95B2D525EABF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jwpzfxcn\jwpzfxcn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES367B.tmp" "c:\Users\Admin\AppData\Local\Temp\jwpzfxcn\CSC15B5007980C64D168420D49589D4A77.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tnxovd54\tnxovd54.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES387E.tmp" "c:\Users\Admin\AppData\Local\Temp\tnxovd54\CSC884A9E055DD8446DA5711C3E32ED4D85.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e4kkd2dn\e4kkd2dn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A62.tmp" "c:\Users\Admin\AppData\Local\Temp\e4kkd2dn\CSC61662FF4C9B0495BB172EA3BD7D4D12B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4yysp0pf\4yysp0pf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CD2.tmp" "c:\Users\Admin\AppData\Local\Temp\4yysp0pf\CSC6B854E7BBFA34C0C9C94C35BD92CD662.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e342g3ef\e342g3ef.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EB5.tmp" "c:\Users\Admin\AppData\Local\Temp\e342g3ef\CSC869C17F8B63C457FA1C1B0543FD4BA1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\robt3q0d\robt3q0d.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES400C.tmp" "c:\Users\Admin\AppData\Local\Temp\robt3q0d\CSC7EDBC2F432094DED8CF9BDA25E29FA38.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ekebdb2s\ekebdb2s.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42BB.tmp" "c:\Users\Admin\AppData\Local\Temp\ekebdb2s\CSCE5636C943CC1495E86D6AFEB83F139A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\avj5nzya\avj5nzya.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4441.tmp" "c:\Users\Admin\AppData\Local\Temp\avj5nzya\CSCB63572CF13A0469A962C98B616A4CE0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3gnh5sqw\3gnh5sqw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45B7.tmp" "c:\Users\Admin\AppData\Local\Temp\3gnh5sqw\CSC5E2FAEFD2C004E159974A0696740EB8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1uoxdr5\p1uoxdr5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES476C.tmp" "c:\Users\Admin\AppData\Local\Temp\p1uoxdr5\CSC13B22883EE3A4D1AA888409329C69697.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pykrlpl5\pykrlpl5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4950.tmp" "c:\Users\Admin\AppData\Local\Temp\pykrlpl5\CSCDEC115633FD2432384CD6BF1B3EF3EEB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cq0irfpb\cq0irfpb.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AC6.tmp" "c:\Users\Admin\AppData\Local\Temp\cq0irfpb\CSCCEFDC3BD484C40B39F62349355ED6EA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kvuy40lq\kvuy40lq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D94.tmp" "c:\Users\Admin\AppData\Local\Temp\kvuy40lq\CSC8CC3B9B177DD4D5A97DC239DAE98CCD8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y4ybjaac\y4ybjaac.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EFA.tmp" "c:\Users\Admin\AppData\Local\Temp\y4ybjaac\CSC2E50687FD0FB4D01B424B26DCF6BF4C8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5hpgzfiz\5hpgzfiz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5071.tmp" "c:\Users\Admin\AppData\Local\Temp\5hpgzfiz\CSCF6663585322C4E0BB91572A3F2F6662F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x01helfs\x01helfs.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5283.tmp" "c:\Users\Admin\AppData\Local\Temp\x01helfs\CSC32C60296FCF146A7AA1217B7DFD7ED7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nx5hgisl\nx5hgisl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53FA.tmp" "c:\Users\Admin\AppData\Local\Temp\nx5hgisl\CSCDB71DB218412448EBCE0D315936861.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\orluzwvk\orluzwvk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES562B.tmp" "c:\Users\Admin\AppData\Local\Temp\orluzwvk\CSCCB670D9042594E07B0194ACA213795.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kjaxtqf3\kjaxtqf3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES580F.tmp" "c:\Users\Admin\AppData\Local\Temp\kjaxtqf3\CSCBBFE5C327C040638A731998D98D5E17.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eic2fky2\eic2fky2.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5985.tmp" "c:\Users\Admin\AppData\Local\Temp\eic2fky2\CSC363DD341E2DB459E967F11C56E5EB2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r4asud51\r4asud51.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B3A.tmp" "c:\Users\Admin\AppData\Local\Temp\r4asud51\CSCDDDE7F25F8F0483194454E8C9A78AA1A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\se4ofhso\se4ofhso.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E17.tmp" "c:\Users\Admin\AppData\Local\Temp\se4ofhso\CSCAB90DBEA574D49ED8EF095F71524B0A4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b0xhwtak\b0xhwtak.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FAD.tmp" "c:\Users\Admin\AppData\Local\Temp\b0xhwtak\CSCB3472D6CDEB2432AAA2A6E9D15E56026.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x4sptnds\x4sptnds.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6114.tmp" "c:\Users\Admin\AppData\Local\Temp\x4sptnds\CSC1BF46F05F45D45B0893BDFEACF3D94FE.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cbnwfodr\cbnwfodr.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62D8.tmp" "c:\Users\Admin\AppData\Local\Temp\cbnwfodr\CSC6AD13C8C2C33412BA946DDC8BB1BF0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xnotbjj\0xnotbjj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES643F.tmp" "c:\Users\Admin\AppData\Local\Temp\0xnotbjj\CSCCAC59AF3B194B41913FC7A76BDCE7AC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uy3ctj1s\uy3ctj1s.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6680.tmp" "c:\Users\Admin\AppData\Local\Temp\uy3ctj1s\CSC90FFEA0074A549159E14667D55D5EDEF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zvjbvwq1\zvjbvwq1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6806.tmp" "c:\Users\Admin\AppData\Local\Temp\zvjbvwq1\CSC49DD6F80C7F14170AEE26C2D2EA142F5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qomxrqto\qomxrqto.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES694E.tmp" "c:\Users\Admin\AppData\Local\Temp\qomxrqto\CSCE4D274E19D054E9D8A5E83E726A6413.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xkyeh1xt\xkyeh1xt.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B22.tmp" "c:\Users\Admin\AppData\Local\Temp\xkyeh1xt\CSCC960CCD110334D238C1B77DD7019212.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lphhybl4\lphhybl4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D15.tmp" "c:\Users\Admin\AppData\Local\Temp\lphhybl4\CSC12C8749E16C1487B8531305DFCB15325.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w5ajwsuh\w5ajwsuh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F08.tmp" "c:\Users\Admin\AppData\Local\Temp\w5ajwsuh\CSC5F22BBAA924341DE89E6B24C7A53877E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tvlxdupg\tvlxdupg.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES707F.tmp" "c:\Users\Admin\AppData\Local\Temp\tvlxdupg\CSC385F93B838A441F8A7368087AAB3F18B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hik02dby\hik02dby.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7272.tmp" "c:\Users\Admin\AppData\Local\Temp\hik02dby\CSC409D72E21C842B185B7A9909CD550F5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wqed0g4k\wqed0g4k.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7465.tmp" "c:\Users\Admin\AppData\Local\Temp\wqed0g4k\CSCD24975E96EEA4D6CA7B2B4829FE4CC1C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o3043xkh\o3043xkh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76D5.tmp" "c:\Users\Admin\AppData\Local\Temp\o3043xkh\CSC2E9FACD281A44288D695A4470193C1A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qibkdgff\qibkdgff.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1896403770-1191418589-375360378-1073107174114438597214213305361876971425447311441"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78B9.tmp" "c:\Users\Admin\AppData\Local\Temp\qibkdgff\CSC4D52A75EE9AD4D7ABA4F3F88F4393E7B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e3hzurwr\e3hzurwr.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A7D.tmp" "c:\Users\Admin\AppData\Local\Temp\e3hzurwr\CSC82A4A9BC6BF94FA0902184AAA322B0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1tme2bz\p1tme2bz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C13.tmp" "c:\Users\Admin\AppData\Local\Temp\p1tme2bz\CSC830C2EEF92094EA987CFB14187A9D8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s5ncqvut\s5ncqvut.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DA8.tmp" "c:\Users\Admin\AppData\Local\Temp\s5ncqvut\CSCB248D22B8D77468FBF32CC8733B6B94.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4effk4pv\4effk4pv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EF0.tmp" "c:\Users\Admin\AppData\Local\Temp\4effk4pv\CSC8075D48178314FBE86DEE89C5CB1294.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v31z4fk3\v31z4fk3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80A5.tmp" "c:\Users\Admin\AppData\Local\Temp\v31z4fk3\CSC2BBAE9324DB345CC9FAF7669108490.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cc33vdjn\cc33vdjn.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "158796884611612127251970830815843305371532689960374439564-1747749125-1661372386"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8353.tmp" "c:\Users\Admin\AppData\Local\Temp\cc33vdjn\CSC665532E1E28A4E6C90369E4D1C65FE.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rc3qpmue\rc3qpmue.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84BA.tmp" "c:\Users\Admin\AppData\Local\Temp\rc3qpmue\CSC4CA5B5EEB62B4F129FA1C99465C76FA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\40mf5wpn\40mf5wpn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES866F.tmp" "c:\Users\Admin\AppData\Local\Temp\40mf5wpn\CSC8ECF47A7532A4FDAA7FD1FC5E7968EB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lt1o0lqn\lt1o0lqn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87C6.tmp" "c:\Users\Admin\AppData\Local\Temp\lt1o0lqn\CSCF5B0682300046D881916EE080F0A8C8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krgibcvx\krgibcvx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES896B.tmp" "c:\Users\Admin\AppData\Local\Temp\krgibcvx\CSC1C6C5CF6DB5C45FB846EA3BDD153565.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\okq1br25\okq1br25.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B3F.tmp" "c:\Users\Admin\AppData\Local\Temp\okq1br25\CSC292D7F2F5678484F9489F56B26C2E3CB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1kyurm21\1kyurm21.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D51.tmp" "c:\Users\Admin\AppData\Local\Temp\1kyurm21\CSCAEFCB258A0DE4596B819A19D4424F587.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvdpfwrc\yvdpfwrc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F83.tmp" "c:\Users\Admin\AppData\Local\Temp\yvdpfwrc\CSC6070EA2A9C8A4B0CBF4D8A28434E1AC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e11jxng0\e11jxng0.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9241.tmp" "c:\Users\Admin\AppData\Local\Temp\e11jxng0\CSC5AC85AD3D4274C639371B7C9EDEAB90.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\caoelcgk\caoelcgk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9379.tmp" "c:\Users\Admin\AppData\Local\Temp\caoelcgk\CSC250C752ABC60435287C3D552D82D4D8A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qsprkbuk\qsprkbuk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES94A1.tmp" "c:\Users\Admin\AppData\Local\Temp\qsprkbuk\CSCA5AE99D82BE14C79B4B6274878A65D39.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gmglrkau\gmglrkau.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9627.tmp" "c:\Users\Admin\AppData\Local\Temp\gmglrkau\CSC4A666A0C33754858A7E5CA4FA85E499.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aqlo3zbt\aqlo3zbt.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES97FB.tmp" "c:\Users\Admin\AppData\Local\Temp\aqlo3zbt\CSC339FF4C0DC8741AE8976318D5B817621.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zn1oelyu\zn1oelyu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A0E.tmp" "c:\Users\Admin\AppData\Local\Temp\zn1oelyu\CSC8AE08D909E1C4782A515BD76212F3190.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s5t1km5a\s5t1km5a.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B94.tmp" "c:\Users\Admin\AppData\Local\Temp\s5t1km5a\CSC9AC16B8ECB864C3E8E936C72C4DD69E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rbfficgs\rbfficgs.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "7493551171106326255633561059-989549401-18717964081654729377-1976584264-107374000"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D68.tmp" "c:\Users\Admin\AppData\Local\Temp\rbfficgs\CSC23463ED1D15240E0B8528ADD6FDA71CF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\525t3zfb\525t3zfb.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F99.tmp" "c:\Users\Admin\AppData\Local\Temp\525t3zfb\CSC340FE75535E6445D9FCC70187EC2EDDB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wejfvsyx\wejfvsyx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA13F.tmp" "c:\Users\Admin\AppData\Local\Temp\wejfvsyx\CSC5EF312ADCAA348F7BFA74965C9D4341.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kiqjitnp\kiqjitnp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2C5.tmp" "c:\Users\Admin\AppData\Local\Temp\kiqjitnp\CSCBD7648E5E84041DE9C7F9B8182C86A3B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\igaostdl\igaostdl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4A8.tmp" "c:\Users\Admin\AppData\Local\Temp\igaostdl\CSC71336EDC53D54EF3995B70BFF997B652.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cl3dtuf1\cl3dtuf1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA66D.tmp" "c:\Users\Admin\AppData\Local\Temp\cl3dtuf1\CSC3328671D6D7945D2AC6D98D3DD2ED4B1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\omsbjtkj\omsbjtkj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA88F.tmp" "c:\Users\Admin\AppData\Local\Temp\omsbjtkj\CSC72E31594F16C4E2DA7A7419983997CCC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xurnyywa\xurnyywa.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA63.tmp" "c:\Users\Admin\AppData\Local\Temp\xurnyywa\CSCA0EE951CF43342C6BDF57ED90B95818.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mldg1wdw\mldg1wdw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC37.tmp" "c:\Users\Admin\AppData\Local\Temp\mldg1wdw\CSC555E3D8436D6455B816ED81FCBB78CAF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rw4e1qxj\rw4e1qxj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE97.tmp" "c:\Users\Admin\AppData\Local\Temp\rw4e1qxj\CSCF3B0F92220014F87BF554D297D92F23.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t2bdpij5\t2bdpij5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB06B.tmp" "c:\Users\Admin\AppData\Local\Temp\t2bdpij5\CSC348FB66A8CE47C18A39453A1335914.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\amq0g2ek\amq0g2ek.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1748683053172953945773920507-823667611-1434221275-951241015484005941836524854"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2EB.tmp" "c:\Users\Admin\AppData\Local\Temp\amq0g2ek\CSCD200BAAFB4DC49E6A3EA2CFF30DBA7F7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tglkdrdq\tglkdrdq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB480.tmp" "c:\Users\Admin\AppData\Local\Temp\tglkdrdq\CSC90C37786BCF34D8CB7CCC6CF219D5FD3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sah5xsyq\sah5xsyq.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "41279695-388768684-170597166-4857657441655791491631594693-341934588-481054424"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB683.tmp" "c:\Users\Admin\AppData\Local\Temp\sah5xsyq\CSC1EC9D81E11494285A5683C94DC7771F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wkgiiohw\wkgiiohw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB960.tmp" "c:\Users\Admin\AppData\Local\Temp\wkgiiohw\CSC3ABD40F476F4483AA117912780127050.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sy5zjfeo\sy5zjfeo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB15.tmp" "c:\Users\Admin\AppData\Local\Temp\sy5zjfeo\CSCEEBA8F7969442B19545FBB6CD83A8FF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n3vvc14g\n3vvc14g.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCF9.tmp" "c:\Users\Admin\AppData\Local\Temp\n3vvc14g\CSCC3EE9A838F274B6BBBD93DB031E2AEBD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hbqb4ifx\hbqb4ifx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE6F.tmp" "c:\Users\Admin\AppData\Local\Temp\hbqb4ifx\CSC87DD024B24D14AF18548281A5C6A48A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p2trjcnq\p2trjcnq.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1511399798-1925719532762726239-832436986-19058685911041270189-1391666800-788744467"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC033.tmp" "c:\Users\Admin\AppData\Local\Temp\p2trjcnq\CSC9FECF54C3ED14704BFAEE44143432C1E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wyvznjue\wyvznjue.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC16B.tmp" "c:\Users\Admin\AppData\Local\Temp\wyvznjue\CSCDAB03469D67A4D85A99C8FE5666EAF74.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\esntgm1l\esntgm1l.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC38D.tmp" "c:\Users\Admin\AppData\Local\Temp\esntgm1l\CSCB0E942E8C67E416C9499792521A4FDCB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\04p0k5cv\04p0k5cv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC552.tmp" "c:\Users\Admin\AppData\Local\Temp\04p0k5cv\CSC31BE8FB39FE4D2A9B5147F1F61C53A0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vw1zl4et\vw1zl4et.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1906574426-80929924-1919923751848904231-21390848511092706724211778591-981384287"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC793.tmp" "c:\Users\Admin\AppData\Local\Temp\vw1zl4et\CSC5363B11E6B54A73A5FEB7454E8661D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uzz0lgla\uzz0lgla.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "301954891619585741-524065849166104127317129104484118962881354473212230659510"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC909.tmp" "c:\Users\Admin\AppData\Local\Temp\uzz0lgla\CSC191E499A16AF4CB18F9ADCBE11AB98F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wnzc2fu2\wnzc2fu2.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-461075638-195485992517065259631969470649-16257823849375832391388197903-179030229"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCADD.tmp" "c:\Users\Admin\AppData\Local\Temp\wnzc2fu2\CSC5C8C9DCEA7545B299DF23B5623BD3EA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qh1xji3m\qh1xji3m.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCFF.tmp" "c:\Users\Admin\AppData\Local\Temp\qh1xji3m\CSC3E4197FD2FDB4CF0B7DBAF55EE92E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v5twyltb\v5twyltb.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE85.tmp" "c:\Users\Admin\AppData\Local\Temp\v5twyltb\CSC3BA4CDDB1112472BB7DDC3F1952054DD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yo3ol3jq\yo3ol3jq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0A7.tmp" "c:\Users\Admin\AppData\Local\Temp\yo3ol3jq\CSC5683F5463A4D46AFA454F8122BF4DE7C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nvjbo14w\nvjbo14w.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2BA.tmp" "c:\Users\Admin\AppData\Local\Temp\nvjbo14w\CSC2A418DE2396C4232ADC4CACBC35C892F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dqyb51z5\dqyb51z5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD421.tmp" "c:\Users\Admin\AppData\Local\Temp\dqyb51z5\CSC260E4DE756E745FEA0BE64BA8967DC0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qu1z4sxu\qu1z4sxu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD623.tmp" "c:\Users\Admin\AppData\Local\Temp\qu1z4sxu\CSC74A9962655D04281A8F622C1578DD9B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzhwawdd\bzhwawdd.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8C2.tmp" "c:\Users\Admin\AppData\Local\Temp\bzhwawdd\CSC7CC94E3FAFEA457A873541A5F2AA5D6A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\330oup40\330oup40.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA0A.tmp" "c:\Users\Admin\AppData\Local\Temp\330oup40\CSC4B02AF6DA7B410A8CA83377185E202.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uvfwivpf\uvfwivpf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB71.tmp" "c:\Users\Admin\AppData\Local\Temp\uvfwivpf\CSC20DE6AA53F446878855D1524EC2466.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h2vacbgw\h2vacbgw.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "810803000-9112999414863505381093647839598663609-29199257-21433877921062976952"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD45.tmp" "c:\Users\Admin\AppData\Local\Temp\h2vacbgw\CSC971F820E3B824F7587DD1531CBA9C7E5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nbhoqjql\nbhoqjql.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEBB.tmp" "c:\Users\Admin\AppData\Local\Temp\nbhoqjql\CSC674596A1EE2146CB8FB3E5FE9943FFC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g3t3b2x4\g3t3b2x4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE09F.tmp" "c:\Users\Admin\AppData\Local\Temp\g3t3b2x4\CSCB0E30085D2D430797F75680F85A79DB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mtlhfiwg\mtlhfiwg.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2B1.tmp" "c:\Users\Admin\AppData\Local\Temp\mtlhfiwg\CSCA39B6489BE3041C2B1ABE0414C54C44.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uum1p0qe\uum1p0qe.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE466.tmp" "c:\Users\Admin\AppData\Local\Temp\uum1p0qe\CSCA2A69C1C1B95497EBB79F3F18EFA4E2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mgo54hi3\mgo54hi3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE5FC.tmp" "c:\Users\Admin\AppData\Local\Temp\mgo54hi3\CSC7C27D3FD42244FDC9EDDE5B1B6B04C43.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bbnld2ow\bbnld2ow.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1284164147-1283210151-592098230-117473740-12559053516509030261351210660788237323"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE82D.tmp" "c:\Users\Admin\AppData\Local\Temp\bbnld2ow\CSC9FD97F0C8E7745609A9569CC6F01EA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3swc1ghq\3swc1ghq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9D2.tmp" "c:\Users\Admin\AppData\Local\Temp\3swc1ghq\CSC1D55402FC1D0491596FA23B0569D145A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yphzpgq1\yphzpgq1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBC6.tmp" "c:\Users\Admin\AppData\Local\Temp\yphzpgq1\CSC76C33C105D8F4FD9867F64E72AA4E6A2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5wanhdy0\5wanhdy0.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED4C.tmp" "c:\Users\Admin\AppData\Local\Temp\5wanhdy0\CSC8BD84108F8E4FED9A5DF4FE4565E90.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhtcq1xq\vhtcq1xq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF20.tmp" "c:\Users\Admin\AppData\Local\Temp\vhtcq1xq\CSC1132F7D580974ABFB47BD913E6B3313.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uzc53x2m\uzc53x2m.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "2030383507-918499241590972502367325927-4756084611438788477639695060-1683145508"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF170.tmp" "c:\Users\Admin\AppData\Local\Temp\uzc53x2m\CSCCF9BC1C14D6E48EF8343E098E33E1CA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghltg0nz\ghltg0nz.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1100704584-2230408198255148905134635-5074481791293475449-1009890996752370324"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF2B8.tmp" "c:\Users\Admin\AppData\Local\Temp\ghltg0nz\CSC4B598112C3043FCA679FA794E886F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ygya50qx\ygya50qx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF46D.tmp" "c:\Users\Admin\AppData\Local\Temp\ygya50qx\CSC14BFB676D9A4F508533C1817B42F916.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2wdkjkjc\2wdkjkjc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF670.tmp" "c:\Users\Admin\AppData\Local\Temp\2wdkjkjc\CSC72D876DEBCF947039C937C48DBBF9D7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w4m20rwq\w4m20rwq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7D6.tmp" "c:\Users\Admin\AppData\Local\Temp\w4m20rwq\CSC4B6FCD511BD446178A46B4E43487724.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3lj5cx5x\3lj5cx5x.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF98B.tmp" "c:\Users\Admin\AppData\Local\Temp\3lj5cx5x\CSCFFF1FDD419054DB5ACD8FAD9B32C6B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fbcgaa2k\fbcgaa2k.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB5F.tmp" "c:\Users\Admin\AppData\Local\Temp\fbcgaa2k\CSC5BE4A28B861841CEA9949E11976BF7F4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pl5narus\pl5narus.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCB6.tmp" "c:\Users\Admin\AppData\Local\Temp\pl5narus\CSCB48C20C4BEDD4EBEA3FC3425B281897E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wmgloxi4\wmgloxi4.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "11333512622111435359-1059111909-989128613-1107320466-2066806342-151009436522640299"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE7B.tmp" "c:\Users\Admin\AppData\Local\Temp\wmgloxi4\CSC93E2530C61F4A508750F43015DEFB88.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xwamn1ip\xwamn1ip.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFD2.tmp" "c:\Users\Admin\AppData\Local\Temp\xwamn1ip\CSCA9D272CB838A4CA5BAD2AD86666588.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\42hlrmej\42hlrmej.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES177.tmp" "c:\Users\Admin\AppData\Local\Temp\42hlrmej\CSC823BE1FF37F14A66A2BB47754FDD263D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4xkpjdp1\4xkpjdp1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30D.tmp" "c:\Users\Admin\AppData\Local\Temp\4xkpjdp1\CSCC8D51F18B50A4319B0E519211D9FB390.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z2jjshkx\z2jjshkx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A2.tmp" "c:\Users\Admin\AppData\Local\Temp\z2jjshkx\CSC4B7E7994FAE94BC7907B3DC5220EEBC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oem35d0e\oem35d0e.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A5.tmp" "c:\Users\Admin\AppData\Local\Temp\oem35d0e\CSCD377B2F03F844B4F8C5979DB49CC26B5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ljrmufqw\ljrmufqw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES898.tmp" "c:\Users\Admin\AppData\Local\Temp\ljrmufqw\CSC99A1A101B99D43428E8B4ED95979DDF0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3tboyeim\3tboyeim.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1128994544352741536-1678619970-544922059593311243875281619-905662913-963085166"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FF.tmp" "c:\Users\Admin\AppData\Local\Temp\3tboyeim\CSC1C07CD21718144AC84A02EA216BD9C21.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oe0yq4x4\oe0yq4x4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD3.tmp" "c:\Users\Admin\AppData\Local\Temp\oe0yq4x4\CSC738F4DB1939A4BF9A35C5BAE98FD1B1A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p2qtmmpv\p2qtmmpv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD59.tmp" "c:\Users\Admin\AppData\Local\Temp\p2qtmmpv\CSC8A159469EC8548018DD6B2C0DE5D1FB9.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5u41mfoq\5u41mfoq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7B.tmp" "c:\Users\Admin\AppData\Local\Temp\5u41mfoq\CSCBB923D42A0A241F19434EDCC61CB58.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nvjbtvnm\nvjbtvnm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1140.tmp" "c:\Users\Admin\AppData\Local\Temp\nvjbtvnm\CSC134FC3AB3A6E474EAE7E3BBFA44169B4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\513tnqob\513tnqob.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES13B0.tmp" "c:\Users\Admin\AppData\Local\Temp\513tnqob\CSCF7A8D78AE5BC485588A26DEE19FB7542.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1rpfdsun\1rpfdsun.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1823599726-51933885619738676681190014229197038035293051879428172691370696783"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1564.tmp" "c:\Users\Admin\AppData\Local\Temp\1rpfdsun\CSCDB0762E8798346A984CB88CB489ADD85.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r2bvdr5f\r2bvdr5f.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "417686301750419513995820611-720160805-19093228542046902089-1029311542-1157522902"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1738.tmp" "c:\Users\Admin\AppData\Local\Temp\r2bvdr5f\CSCF8970C51B273465D9EBF166ED8A18BD9.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gfpj4hxo\gfpj4hxo.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-8980042441151841446374728281628181831853460432987305742-13274186481237015605"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1989.tmp" "c:\Users\Admin\AppData\Local\Temp\gfpj4hxo\CSCAB5AD8D25137405AACD9881D773A125C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wroxonp1\wroxonp1.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "6489554081216052728181334096-404888671-93831361912783352196019475371252617916"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AF0.tmp" "c:\Users\Admin\AppData\Local\Temp\wroxonp1\CSC24A18262F4F9465BB44848323716DC3F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k5wsklda\k5wsklda.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D02.tmp" "c:\Users\Admin\AppData\Local\Temp\k5wsklda\CSCE3A573E1E92540B38A99A09DAA1FE9D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1zay3mqo\1zay3mqo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F72.tmp" "c:\Users\Admin\AppData\Local\Temp\1zay3mqo\CSC6A3A5D5C7E3B4C738A5E71177C78C178.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pc0f4vfa\pc0f4vfa.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2118.tmp" "c:\Users\Admin\AppData\Local\Temp\pc0f4vfa\CSC2A7B44C1C22048C7813C26F4C3C74B96.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jo2rpy2h\jo2rpy2h.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2397.tmp" "c:\Users\Admin\AppData\Local\Temp\jo2rpy2h\CSC6AA3C029C7844F8F9C9CB5DA49A1DFC5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\efpjqn4i\efpjqn4i.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES252D.tmp" "c:\Users\Admin\AppData\Local\Temp\efpjqn4i\CSC3317FB3122C9408BBA6C34E97E64652E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ux1n43us\ux1n43us.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2730.tmp" "c:\Users\Admin\AppData\Local\Temp\ux1n43us\CSCB171214C4D074F62B4B0C8B5C7A485D0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dbjbj5dc\dbjbj5dc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28E4.tmp" "c:\Users\Admin\AppData\Local\Temp\dbjbj5dc\CSCDE96F4DB49D84B8ABDEDA851B89533E6.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xfhkktjd\xfhkktjd.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "17334356822640799111460448327143584547-2065991426-237790737-1024909525289372494"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2AC8.tmp" "c:\Users\Admin\AppData\Local\Temp\xfhkktjd\CSC57AB1D4332CB48C6B3B3D5D8D68FCF0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ivipj5u1\ivipj5u1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C2F.tmp" "c:\Users\Admin\AppData\Local\Temp\ivipj5u1\CSCB41F5D7B454B4A639BB022408D1F572A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y2jejojc\y2jejojc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E80.tmp" "c:\Users\Admin\AppData\Local\Temp\y2jejojc\CSC99163F278947379A6787F1AA63382C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etuuf0s2\etuuf0s2.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3073.tmp" "c:\Users\Admin\AppData\Local\Temp\etuuf0s2\CSC5EE4E03FDA9145C799C1F03C24761C71.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ohrrb1ph\ohrrb1ph.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31DA.tmp" "c:\Users\Admin\AppData\Local\Temp\ohrrb1ph\CSCD48D3FA16C048E8AFF376C52DAC7E7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gzo2ta1p\gzo2ta1p.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33CD.tmp" "c:\Users\Admin\AppData\Local\Temp\gzo2ta1p\CSC907B09CAE3D74EA992A23FF5AD1652C5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5zbldtaz\5zbldtaz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35C0.tmp" "c:\Users\Admin\AppData\Local\Temp\5zbldtaz\CSC46FF8380B2F34615A99CAF5D0E0E9B2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jtz0nj0o\jtz0nj0o.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-193038059819783608121619176718-18361266001759028251701509531-1367160602-203854390"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3746.tmp" "c:\Users\Admin\AppData\Local\Temp\jtz0nj0o\CSC583E7115BD4453887F2B81F31FF905F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\44mjvf5e\44mjvf5e.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3968.tmp" "c:\Users\Admin\AppData\Local\Temp\44mjvf5e\CSC72E6D45BB7594FA8B4A82FEDDEDAF8F0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tzq2yyo5\tzq2yyo5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B0D.tmp" "c:\Users\Admin\AppData\Local\Temp\tzq2yyo5\CSC350464F5F91B4139AE743EF745438C63.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5jobiujp\5jobiujp.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-388728106-1928318279-892487517-16019595321250157620-793526008-1750256021-336362451"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CE1.tmp" "c:\Users\Admin\AppData\Local\Temp\5jobiujp\CSC3DF5E76675C74D7490F64A7B464A39DD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qeqr3gzi\qeqr3gzi.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E96.tmp" "c:\Users\Admin\AppData\Local\Temp\qeqr3gzi\CSCE1CAF01F654F4E5F941AF6AE9A6EF3F2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ir4pdmsz\ir4pdmsz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES404B.tmp" "c:\Users\Admin\AppData\Local\Temp\ir4pdmsz\CSCEB83663538CE4F63926133CFEBF2684.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zlfmtp3l\zlfmtp3l.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41D1.tmp" "c:\Users\Admin\AppData\Local\Temp\zlfmtp3l\CSC30CA17C0A47A4D8E80A7B8EA9D8DC8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2wavjken\2wavjken.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43A5.tmp" "c:\Users\Admin\AppData\Local\Temp\2wavjken\CSCEB1C890359DB44A79EE7E48BE37D395D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5nxoqct4\5nxoqct4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES451B.tmp" "c:\Users\Admin\AppData\Local\Temp\5nxoqct4\CSC60469997AA624115BDDF96DC8C7D3FD3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z0onxbbw\z0onxbbw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES472E.tmp" "c:\Users\Admin\AppData\Local\Temp\z0onxbbw\CSC766C2734C48C42A6A255961CFFAAC2D5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v2ei1ouo\v2ei1ouo.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "4479466681311391589-11790736991318732120-17297471751673057302-4796794101920065636"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4902.tmp" "c:\Users\Admin\AppData\Local\Temp\v2ei1ouo\CSC96F2DBC085024B92889ED0FD302AD4A8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o3yaac11\o3yaac11.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B52.tmp" "c:\Users\Admin\AppData\Local\Temp\o3yaac11\CSC922BBCB9BACD4F719B73F491903DD04C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0szbegkm\0szbegkm.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-20436592181485934761875870899240228072-1386066774-191337824619400458291058592149"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D46.tmp" "c:\Users\Admin\AppData\Local\Temp\0szbegkm\CSCE2A01D78266D471184C56A7329729088.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wqiqf2h5\wqiqf2h5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EDB.tmp" "c:\Users\Admin\AppData\Local\Temp\wqiqf2h5\CSC819538888707495B902092D5B362F552.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vnnnbs52\vnnnbs52.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50EE.tmp" "c:\Users\Admin\AppData\Local\Temp\vnnnbs52\CSC58711645D1A749A49763977480943ABA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2detaug0\2detaug0.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5293.tmp" "c:\Users\Admin\AppData\Local\Temp\2detaug0\CSC4E536D9537E54A17B8F1EF7B75795C8C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aawfqt4u\aawfqt4u.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "465046893-5129954941199720382-15802884971763571459-17405665501084079102-1778594665"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5512.tmp" "c:\Users\Admin\AppData\Local\Temp\aawfqt4u\CSCF0A04D3F9FB8479BB09B4FFDAB8C52A2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\poomualp\poomualp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES564A.tmp" "c:\Users\Admin\AppData\Local\Temp\poomualp\CSC37E25DC5D62A4EBCB88D46F5609E581F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b5prl4yu\b5prl4yu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES587C.tmp" "c:\Users\Admin\AppData\Local\Temp\b5prl4yu\CSC8E770BEE1B754685B67AC6607D316D13.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lpjn2t11\lpjn2t11.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59E3.tmp" "c:\Users\Admin\AppData\Local\Temp\lpjn2t11\CSC17954915A8564C57ABBDE213225B4E0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kdmmnnfc\kdmmnnfc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B3A.tmp" "c:\Users\Admin\AppData\Local\Temp\kdmmnnfc\CSC1944C2F761594C1D8034699142EC7078.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fbrfjzib\fbrfjzib.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D5C.tmp" "c:\Users\Admin\AppData\Local\Temp\fbrfjzib\CSC4174155F6B8745C7B22AC511276BB671.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eexuu5ml\eexuu5ml.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F21.tmp" "c:\Users\Admin\AppData\Local\Temp\eexuu5ml\CSC699FF2E446914ABDAFC6923083609A20.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aqklepfl\aqklepfl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60C6.tmp" "c:\Users\Admin\AppData\Local\Temp\aqklepfl\CSC8E8A7D7C4AC54432B731BABF482D9E86.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xx1ltdsm\xx1ltdsm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6365.tmp" "c:\Users\Admin\AppData\Local\Temp\xx1ltdsm\CSCADF4E8D54D234625B3D989CDE1653F5E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0hfkmw1y\0hfkmw1y.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1479739836-275986382-1237573380-10827739761246274311-557683387664169299-1600775180"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6519.tmp" "c:\Users\Admin\AppData\Local\Temp\0hfkmw1y\CSC2A1BB5B4A2ED4B149AA8CD6088FA3F1E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qo53xpln\qo53xpln.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6671.tmp" "c:\Users\Admin\AppData\Local\Temp\qo53xpln\CSC4A030184C5C64BB4AA37F6126E8DFFB5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y4n1j1qe\y4n1j1qe.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6835.tmp" "c:\Users\Admin\AppData\Local\Temp\y4n1j1qe\CSC612B0886B70495D9C991B92913084B8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4sulfulo\4sulfulo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES696D.tmp" "c:\Users\Admin\AppData\Local\Temp\4sulfulo\CSC7B33DCD626C4F4A8FFEA61D7F871483.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t3mjzynp\t3mjzynp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BBE.tmp" "c:\Users\Admin\AppData\Local\Temp\t3mjzynp\CSC24ED86AF2D0E4A63ACD3AA4DC6C441A7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qcjyq2ex\qcjyq2ex.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D05.tmp" "c:\Users\Admin\AppData\Local\Temp\qcjyq2ex\CSC8C4247ADAD5C457DA0958A129BF53B64.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rdktvv3d\rdktvv3d.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "25698108372153423561344499734740348983744994486623595714177125751100402135"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6ED9.tmp" "c:\Users\Admin\AppData\Local\Temp\rdktvv3d\CSC502954C9C655427080A7653B05BBE16.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ojarjlmk\ojarjlmk.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-976200473141565256972546380-20739923712602486615373644351173352740-1259996432"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7031.tmp" "c:\Users\Admin\AppData\Local\Temp\ojarjlmk\CSC20A46A75DB4949C796514F5FE7CF1BA3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t5i1ltyo\t5i1ltyo.cmdline"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1964367147-1678720939-2004565240-991593356414587745-1155390841296334843-159639400"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7214.tmp" "c:\Users\Admin\AppData\Local\Temp\t5i1ltyo\CSC8F22A79B1A1B4F06B987A41FF897EC0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0tnhmbbp\0tnhmbbp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES735C.tmp" "c:\Users\Admin\AppData\Local\Temp\0tnhmbbp\CSCFFFADF731D4647E7A419611E334A3BB0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1tzn15rh\1tzn15rh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7501.tmp" "c:\Users\Admin\AppData\Local\Temp\1tzn15rh\CSC2F2E78798A6492583F550641C585171.TMP"

Network

Country Destination Domain Proto
PL 185.244.30.251:1122 tcp
PL 185.244.30.251:1122 tcp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 meeti.hopto.org udp
PL 185.244.30.251:1122 tcp
PL 185.244.30.251:1122 tcp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 meeti.hopto.org udp
PL 185.244.30.251:1122 tcp
PL 185.244.30.251:1122 tcp

Files

memory/2132-0-0x000000007448E000-0x000000007448F000-memory.dmp

memory/2132-1-0x0000000000E60000-0x0000000000FE6000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\jmltmjot\jmltmjot.cmdline

MD5 858c4c35ed7995bf9ee9ada9b86fd756
SHA1 2713ae3628b12483d1c750a3f2448e36f4c22360
SHA256 16078e98ff4b5ddd3f908fe2398670570e813a4816c6866cc456e1fb245904b4
SHA512 8a58f5747b2d69e03b5b995fc6a095223ac89087d8435c67913e131200ce093dc6cb25914e1ebfaad7c0b000085fbcc0893e3ca90f0a991e75a75bdc0bf3a66a

memory/2132-7-0x0000000074480000-0x0000000074B6E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\jmltmjot\jmltmjot.0.cs

MD5 3add63d70f7cf265c31ad4493b45a28d
SHA1 b125041f6d712116143020fe3b4c0deaab678143
SHA256 f20c56aaf9f9f21eb0e5cd84d863176f442d8bb0a59ec2ae4f91c928a4754bda
SHA512 e4614a662da9db59e126885ea8e7c42e605438e3a09dd7a71b4a5ea8a0182bf8a2a4f6c0fefa5761bb24527940cddb6644a1e27537afac9231fcddbc297b4a9d

\??\c:\Users\Admin\AppData\Local\Temp\jmltmjot\CSCC703CA0A8B624A2092B4A27A81AEE23.TMP

MD5 99b0abe0e9d48ba902287f4557e25388
SHA1 5d51595846a32cd8a822145a08115208425b2051
SHA256 091123f15c4b2781bb61537ec45b8ff0b68745b3547e0492134e9c6988b86255
SHA512 c2b9946f41cad47ab26c51be16a5d10be4f0645f459388ccd60651237bc76d59f2fc1aa924c076300b53f7fea711e1b3c53ccec945cfb9dbdaf0af8f30f47a16

C:\Users\Admin\AppData\Local\Temp\RES2108.tmp

MD5 224c8c07c81de7211b678b27bd53a6be
SHA1 2c6208573f20f98af2259c9ecb474f35aa0dc0d6
SHA256 6ac018c8fe38657e34da55041ce76fc1600745963b15d62b9d65b1d2a00d7495
SHA512 78d3bb330c9b7f97a451426ac8d422afd7741992e0defb85c085da80136cfa554366a631b84ec653f32e4b35ec9c161c58f9e9d8d7942d989f89271c171f4b85

C:\Users\Admin\AppData\Local\Temp\jmltmjot\jmltmjot.dll

MD5 64567af81ee45fbacc6070bc5bac25bd
SHA1 a32b352af48c4a374cf0a3967b299f967aad2f38
SHA256 b84acd116fff44427e55356e542d825bd2f75f533767b5c41e163f873d5da2e6
SHA512 8d5b9d561fdbfbae35097903c6a9f5995922c18ee603f48b36d1da5ea1e499e45bf6935efebed317ecb1a7fc973ed37b062342df6604400ab3d1b38a34d1b51c

memory/2132-17-0x0000000004E80000-0x0000000004FE0000-memory.dmp

memory/2132-19-0x0000000000DB0000-0x0000000000E38000-memory.dmp

memory/2780-20-0x0000000000400000-0x000000000047E000-memory.dmp

memory/2132-25-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/2780-24-0x0000000000400000-0x000000000047E000-memory.dmp

memory/2780-22-0x0000000000400000-0x000000000047E000-memory.dmp

C:\Users\Admin\DocumentsWebSocketCloseStatus.txt

MD5 d510225b94b0ebe2d5414699b2a89771
SHA1 3e79f1ea8c96ed35a27247227c533c5c4dd6010a
SHA256 01d57933cac2d50b0b439e322323f20b0083302f1ae80263ff151f3390f4be24
SHA512 dc28498c4b43efcbe4969e65cf6f509a352fb2221905a1eeb43b955bab2ed55852e8167d13f9dc83b736c8b0ddd6b270d8d7c120720fb6406279c17aaa43e399

\??\c:\Users\Admin\AppData\Local\Temp\rtqk1qrv\rtqk1qrv.cmdline

MD5 657c902b7d7bfa757855eb7ade9d5321
SHA1 76d35a87bcbbbd11d880b95eeb851e18a27ba426
SHA256 4f777d2ecb5b592563da11fcc765a7cf6df0197e56b7d992cf1f69b267df3520
SHA512 0e833fee7719dd5a88fc62226f87d9bd60fc909a010ff692ace0dba8839380d29fd826dabdf44bfbcd3051d83ec42f4f62d751c79a4bc37d059c20750e488849

C:\Users\Admin\AppData\Local\Temp\rtqk1qrv\rtqk1qrv.dll

MD5 f2ece0a4b38f6aaf495c393144351646
SHA1 6fb8fcc174d2ea27f53ce4dcbf17f27bd3737970
SHA256 7224046a4c8f14b065178ec8082b1cdc54d47c5f86eeee2a3ff7c8f2b84c252b
SHA512 f4ef7640c694fec1403be09c08f818d9268160785e4b2fd6eea2c18cb628917956249919f66e5b7de0cdbcf0893170a1ff00ced5fb8e85cd9148bb8fd84d0f96

memory/2840-41-0x0000000004E50000-0x0000000004FB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES23F5.tmp

MD5 3a4878a9154cbb61f9974782525ae6e8
SHA1 9b762c4125984e5f20790727619d4d1b58eae1d0
SHA256 1fe231c87dd59307a241f4c9554b4024acc73e20447ffc0df6a15d9c419f808a
SHA512 5847543acc147468bcd1d87559303bcfa08a28c42c3911ae73806e1a87c6fb80af5bdf8675afa5ca2b8da521d067a4723c038b142bd10c7ac146136b4ada04ff

\??\c:\Users\Admin\AppData\Local\Temp\rtqk1qrv\CSCED9F6F2B9F74892BF7E26EC16C4BF13.TMP

MD5 81f1ac7daad826c045dbac131a798879
SHA1 4b394a51b55cb856bac692e2a4859ae7e8eff51a
SHA256 f1e85cb990f7c61e973c9cf27dfb87138a7b1776c626f7370145e06d2a792ba8
SHA512 d63b53853a4a5406565579482716db6f43239baebd2448b8bb12c9289c434b428a0759ca7905c820af4750ccb8da72c1273d04ba935de6451c89f5add7fe21d6

memory/2132-46-0x0000000074480000-0x0000000074B6E000-memory.dmp

memory/2520-54-0x00000000003A0000-0x00000000003AA000-memory.dmp

memory/2520-57-0x00000000003C0000-0x00000000003DA000-memory.dmp

memory/2520-56-0x00000000003B0000-0x00000000003C2000-memory.dmp

memory/2520-61-0x0000000000860000-0x000000000087E000-memory.dmp

memory/2520-60-0x00000000004E0000-0x00000000004EE000-memory.dmp

memory/2520-59-0x00000000004D0000-0x00000000004E4000-memory.dmp

memory/2520-58-0x0000000000480000-0x000000000048E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rbvin2x0\rbvin2x0.cmdline

MD5 2974dcc0b6eb4b0805b853abfbe9dead
SHA1 b0bd54b8454896d625bdfa01ee67ab190f0709f3
SHA256 8fccdef71e5babbbf5d324bf7eac602d4fe51fdbba549cd08d2ae4117d41a84e
SHA512 58c31fceb87acb8d789b44305761656b47fc3349047b8db27abbaedd6c3895b06b533756387428b4d49ee29fd61f14e15de86bdc6a382912b96ba419ff872435

memory/2520-62-0x0000000000890000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES278D.tmp

MD5 ed579c6fbe089ec69fc72e2db852e6d7
SHA1 60c885ef7dbc020d55751dece265572f436f0a79
SHA256 8643869b94e676c90f52b8158d558732ee4d44e914fce56469e7d1698f7f10d2
SHA512 83b60a2ef3ff0e028615214ec4e853f5fc1a510de8d268efded92be3fad4ffe76be5f8f8794f13fbf2c95e6f0336afcd6004d6a62fe3377d9c48b1c00f358460

\??\c:\Users\Admin\AppData\Local\Temp\rbvin2x0\CSC15B017D68F814E2490D699749436FFA0.TMP

MD5 77fbb8894049bd7c026e95f27374aae5
SHA1 6e646a261f3e18d0a9a629cd45abe434aaf7559c
SHA256 d18cc3912e87633f2a304bf34f7c76f3d6365df7d53150c9e15bb49d654e6982
SHA512 d33c1cd18181240b381c6792dcad9edd9545a1647b3ae2b6070ca52e202b021f2d2e3db973f2ec4c2914aaec6b4988cd05e715f170fb7ddd75e1965905dc8edc

memory/1828-72-0x0000000004DC0000-0x0000000004F20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rbvin2x0\rbvin2x0.dll

MD5 06354eb32a34505f94e45b26968c966c
SHA1 b098343576acfd9449b4f36c5cd9f9c2413fd7ee
SHA256 136116b757cdd1fcda26ea0dc658f73b7b5e87505e8496fbab9849174af869b0
SHA512 6d7243a4db19f249697a3b7b42189617eb3747841c083313a8708820ba20e96c786f34c1347a38fceb719c0f508055f0945249e3cfea3a13440e623c35214344

memory/2520-74-0x0000000000A60000-0x0000000000A8E000-memory.dmp

memory/2520-75-0x00000000009F0000-0x0000000000A04000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\y1btixp5\y1btixp5.cmdline

MD5 9339827ae2eb01d069d3f653963570a9
SHA1 8ae883fdf90aaa80163dce96290f680301aef00b
SHA256 53d8320f42fde5044755280402ad7d43f118de6cdce92a165650fae8571dfd22
SHA512 5226464a83c0e93868cae72431e8ef240d6944efc4ac17dd5da2100d7bf37ddad8136de46d11f9a0a5ce0fad046211272324c73edbcd2cf43fde7564f6b80117

C:\Users\Admin\AppData\Local\Temp\y1btixp5\y1btixp5.dll

MD5 2bca0973083c9353f2549a887314e777
SHA1 a7978516d16c49750302c5b04c4169f2e17dc820
SHA256 27f935f67ef452a1fbb89090881dbbd8e5b2d92e6b73e2856ad89790d8a94837
SHA512 abe81341945d28cf92bbefc96ffeef38fca5618519ce9ce85b0a8888662ae1091bd8753fde2aaf29025c9ac7474203c1c752e65f4edef772c95a77ea18c1bad0

C:\Users\Admin\AppData\Local\Temp\RES2AE7.tmp

MD5 b0e426d70258b06a44e91e35802d139e
SHA1 cd7f0a87ded2d2ae7f758a46383c95d9a60962b4
SHA256 4c7367e6fab96fcbb74addb2ee986079f65e010526ce2f63aaaceda35f2de1ad
SHA512 12c1616d82553756682f81ad6c379107a7df9b756d8a1d99dba1ade36992e7be38ceacf515d0f3720a50b7a26dbbf04bb905cc1856b496dc2a995fd59b4b9388

\??\c:\Users\Admin\AppData\Local\Temp\y1btixp5\CSCB3741DE0835245508EA264C16538199.TMP

MD5 6730393c7a6796697a1d29f95879664e
SHA1 b5310c62d38fe4df6dc0066218e68cc804ee8342
SHA256 c5e249f06810bbadb62b0f5af611de6032dc9cf31b779dc238f49e322734dff0
SHA512 5be5739b3ccaf2968b27d49fd55c909ed16ae2cbe61fd30a939eead0df46d9ca0a2e84a6d821e6737ffceef8a063456ad53ec115f011c528a02712ba5f4420b6

memory/2436-94-0x0000000004F10000-0x0000000005070000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\2bufnzue\2bufnzue.cmdline

MD5 0677a1ec17594c54ff9efb9bf6047634
SHA1 62ec8b0e3254ebd3b51a35fc749825018aa9f8e5
SHA256 41f5d33c3bbbeab4d4f964446f6a01658c72910cdb8aecd10a947df2e64498ae
SHA512 6703816c579feeab87957c0dd48438eb22259a852e72f6d3529649f52314dd43821c450fe40ff50dff7309da44381aacbba34d4c54cc0c4a9dc28ad74305a06b

C:\Users\Admin\AppData\Local\Temp\RES2D76.tmp

MD5 32f0d02bad80b9130a740b097dc076b7
SHA1 d7cfcde9fb5077c8fd4c8315c8a899aad153db5b
SHA256 e05aa409873c6bf5e9c9dfbda603568c37c1f621115041e1cbf5e3efcdca3a22
SHA512 7bcf5271191f5882aee758db0b8926fa72906a56f521c59b9cddf36aefadae9d5f30dcefcf8e4bbc911020d8c911e10d9cd1619753e5ae09994b1f24d47c1252

C:\Users\Admin\AppData\Local\Temp\2bufnzue\2bufnzue.dll

MD5 6e485d8053621760b238054af7a4529e
SHA1 f5d858e40756891f5ca298ca9da390061b68f855
SHA256 1c76cfc8ae049a3a25cb6f744c6f6e7bf5c5cd59eb1f2a7b5cb5764a82d06588
SHA512 94d38d627fff357dae3d98b0a5508f29ef108f7b4b1d190e53957f313d42796a95606d7e5e27990bf761739158786a0fce58cbbd21e491b5c2c7ed2be16e011b

memory/2280-114-0x00000000051D0000-0x0000000005330000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\2bufnzue\CSC73882813913A422392EBE1548DAAC543.TMP

MD5 7b81e328e7ea3bb5353009c8eef44dc0
SHA1 ca48e75d109d57324c00676b9893c113d85fda3e
SHA256 cde2289e581bd8929c0d5caf2fff3e7bb45bff601cb9edcf5de1400d186f9469
SHA512 dd162c9db3629f7ab062abc76289d7c6b6ed6ae7ceb506b753d35aa74f86fbd1417e14784420f14c3678834a240dd7d46576440eedeea83abda5b81e42f62143

\??\c:\Users\Admin\AppData\Local\Temp\to0zmow3\to0zmow3.cmdline

MD5 a2b4afdd0a40b553eff5ee8f01c8edb0
SHA1 daa00ed5e489bbabc23ff12221fcafd5fffb1877
SHA256 226f4af9c415ebd08043b5ada8c701018d2eca46a24e78d5b491a4525b2b5bc2
SHA512 e1a4be3440981137005dfc29a987ed2f224b87930974e24822b0f48746fd5e8681bf3707a015de476d045cfffc4769a4d69fab0922090f754575c750704ba8a1

C:\Users\Admin\AppData\Local\Temp\to0zmow3\to0zmow3.dll

MD5 a8f71a376aa92bb14cdbe7574be7a406
SHA1 37483b50d856f9f4b1e802feaead742794c01a56
SHA256 3be89a3f36b3a295a671b1dacb7ab0340b227429ca58429fb0d93d41914f6bae
SHA512 b11fe5618b91e93273edf65d5584e9aa2f86a4e7d4fadd48f20b67b5e69dc51af62c5c7f971c69706612eb449d6f1910c7b8ad68efb89ac63f206fe35e96ef3c

C:\Users\Admin\AppData\Local\Temp\RES2FF6.tmp

MD5 2d34300d6d2efad8c23ff1ce66fcccc4
SHA1 cba41135228d0ed4fd87654f8e5b55fef7c2ac17
SHA256 f37d7178cb3b303c08c3b22ec481a7ce8721192c11ca74b7206e02d512a7c2f1
SHA512 7b92f19e64784bda360b8e72e7f2747bdb1ce06bf50f0596ee390cbea205d89fee9b0861f427b460c94efa7a27ecf3e155bd01af53a8e1e275ee6cbdb25e8940

\??\c:\Users\Admin\AppData\Local\Temp\to0zmow3\CSC48944E81E51A4BEF9D817CB1905730F.TMP

MD5 da201473967e03b6a37afd69c8eff170
SHA1 cd7ad8c7bc0b506778fff39ad2f2eb01ccae5df6
SHA256 9cfc4c8ce37d226b44b2c19d15c26f6c257ef16650de3513a4ab9a21438d2005
SHA512 3e7ca7efd387caf32bc7a99581edca69fbca0a0419a2c4bd2b8360cffc332dcfa2605bd5d31a3c0c1badd209978eaec0db81b6ce99a52fec6825f75990d07651

memory/2736-134-0x0000000004DD0000-0x0000000004F30000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\tdtvn2ph\tdtvn2ph.cmdline

MD5 0408b0e20aa7073364075a4cb79f7c5e
SHA1 263fb6c7227c214c70f43e85ea008589e834b281
SHA256 9669fb3be0fca22dbdeab95341839ac612df8276ea55cf0d6ab6d69ffc64e4c1
SHA512 1c556999887aafacf75a4c3b2df0c455f831e4a13225ff93b574797b9ea495ae832ae99adbbce769c8e40115d13dc63c7460e1c50074340ae760529ac4cff6d9

C:\Users\Admin\AppData\Local\Temp\RES32B4.tmp

MD5 95896bb85226ed9b4f68f6a83178562d
SHA1 8db5459600ef2ae016c326f803a9e8ab14ac3e5c
SHA256 535f813ce94ff8c4650e34c27119cdd618c5df0e88116a636355a338e85c6173
SHA512 f2871a447d1dbc669b555964d2d00ad89f5ed9d716fb0719afdb5d8653253cd672f9f7d1e724f7eeacbd22f47961ddaa2e67d5b6dbadafb1974940c3e4aa04e1

\??\c:\Users\Admin\AppData\Local\Temp\tdtvn2ph\CSCE4707B00C65F436B83EF95B2D525EABF.TMP

MD5 b97b9731b74991f1e6d73e81b23ffba9
SHA1 b4a78f790d6aa8b0af29e6b8fb9470d4f464a1ae
SHA256 14d9792af87a7880a2fa3c5236268d9a551a7bfd3289442e95432534150eac30
SHA512 c9d1f0b1b861d6208539b9d20391629a43f62b7be306213fb7e87ff57943a1b396dc7588ac2517e59b11c05d36b5dddb1a0277b4ebe03ee66f8b5ae91042ca0c

memory/1632-154-0x0000000004D80000-0x0000000004EE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tdtvn2ph\tdtvn2ph.dll

MD5 284b95e1f734d9849fc53e8bfee8f951
SHA1 33702f4d00b6f2862beb56843df22b8d8884c626
SHA256 0580229f70f1db636aaeb83ca3a256b9734f736a1be2d82eecd73b2bf91c7d6e
SHA512 481efa908bdf22e8228e6ae14573d58990eed0c11875b1c36ebb8178fe1717c5b1a88f3b248e4899f0a3d2be209d7ad6965746e4f6806b7e85fff2679446a8ef

\??\c:\Users\Admin\AppData\Local\Temp\jwpzfxcn\jwpzfxcn.cmdline

MD5 cc9d20d33f96bd55cc7983485d7a79f1
SHA1 c8bce2569607133febb5f40041d4c25317f51804
SHA256 89fd6d864c09dd7b2a3247eb9bbd2f518d69166aea46294935c3bda957cec8db
SHA512 dec6d429b72ad44c1c3165fb6237d5506620e4017e8c39def7bf1a2a3bfc238bb7c0c31d4edd95261523e5bdc4da84063b0224512e57bc1c50d4f958917225f3

memory/1236-174-0x00000000023F0000-0x0000000002550000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jwpzfxcn\jwpzfxcn.dll

MD5 37b3c64a00c3b652db6afafe9e489038
SHA1 aea71ada3e90db1c86833b505e2e226259b0d713
SHA256 ff737b8c1f99b3181f0d18d281538500662b7848eb319bc55b19d5ae4e995d11
SHA512 8b724111cffdd4bcb8fffcc157fc45103f769f09f28fc40bdad9569aac8985610b562a26858b4f5bf48534ae7eac6bb1b289b59495c556dcd382571295103cfc

C:\Users\Admin\AppData\Local\Temp\RES367B.tmp

MD5 1b596c9aafd0645c1d0ef994248da8ae
SHA1 0d38c43bf0017b54db00fc888700fa6c39104b01
SHA256 c615b9efbd5e64d689dfde666cf693acedf518dfdde454c0bc85a1b282b348a5
SHA512 a2d7c923c3e470bfe917f422dfdaa02b974f7c30c3afcaabb6df768bdf2627b045bf771909ad6110bd19feb9c0064e6388761b8b68f77f97b83dbb1af5fd81c4

\??\c:\Users\Admin\AppData\Local\Temp\jwpzfxcn\CSC15B5007980C64D168420D49589D4A77.TMP

MD5 7dafd5cad3c1d1bfeedfb0d861a5fb87
SHA1 9062dba9da0a5f606aecdc55c77976c88fb7c2ca
SHA256 0a004a4e6bf096674b82bd3f00cee28e0ead089a4191d123b5d9548ae82fbce7
SHA512 317e60d5304ef92b416a8f7af5f37efb12cb83899b46d691e06ed84280c7df47531bd802c6380a38c34bbb91213be9437bef20b769dcf85b5b2a48784eefff77

\??\c:\Users\Admin\AppData\Local\Temp\tnxovd54\tnxovd54.cmdline

MD5 af5884e31c7e07bafb5a1c6dae257cd5
SHA1 6322b161410b277d79238e16fc6e68280c7207ba
SHA256 2a44b8f1ad12060f29f5e1db4d16f3143cde33c8b97313e609e2e075d77cb798
SHA512 f59ff5ac391dca9a91d31ddc349f06887a1393def4393621fec8bac54f6f49ade5f02a9ab52d00ff933e3f82db5e575b9668cace896b746da6eb29f9433349e6

\??\c:\Users\Admin\AppData\Local\Temp\tnxovd54\CSC884A9E055DD8446DA5711C3E32ED4D85.TMP

MD5 691048a3f89872f86aecaaf04230c46d
SHA1 11ef9a613fd566b70a39a2d7ba38a07899a7d421
SHA256 c3199ef3fd03163e82ab1ab986b593dfd1f13796f25ca60f76c6e33b98dd0cc1
SHA512 fce6e4730d2c4a7baa1c159fdd65b5933c67e20ee32b7a7c2cafd096dfddb5b6ef22fda384ce6c2bf5ac6fb665073d523ecd54a08fcf75f1ed1face9c3dd77a7

memory/2004-194-0x0000000004C40000-0x0000000004DA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tnxovd54\tnxovd54.dll

MD5 60fd8bbe0d21673795d3d2a3a657dd75
SHA1 c1ad4f3304900ee209eedd7fbfe02f77b9640435
SHA256 338b5f5164c6ba570ebdb91c21f07d0ad16dc809cf3c37d556a6dd94e5a216a7
SHA512 2b9fafbbd7b04be7d8f68168cfa55037f311222e25606d68425c96c5cdc265ec1a7a1bafd9084c6d3082e764d888d98c656b77ff7ff0051e873656bcd71df2b2

C:\Users\Admin\AppData\Local\Temp\RES387E.tmp

MD5 6e3a200558fe5a1a70248bac6ff45572
SHA1 ac7a0bfeb66428d5f536d66caf9e49d118280856
SHA256 1b8273063a6b7607fdc5279bc81a21f93ffc38ea06302fcb8d9a0bc8e011e575
SHA512 64305ba2d49d31516b2e8b159aeb7ab48e3d340a350ce5568792eae68fdacda2e1d3354c70fba731099476fe10ef58b33fac11381ed0c6bcb83f7d5a15c42be2

\??\c:\Users\Admin\AppData\Local\Temp\e4kkd2dn\e4kkd2dn.cmdline

MD5 8232f9ed31ce0f4cd03d01d21f574dd8
SHA1 661fed34b645962c3b2ee5bea13b373b6e245dff
SHA256 ceff95cc2bdd90f9e1ea26d9ef536a02875741756d4a26b0f9bb6b6a4eafea56
SHA512 6840a60b47539f8602f07d1fbf3b88472595ac55ee98fb5ca71dbbb0e7cebdf4aeef4bb7092451330ec2408fa4b1b843947c3a89cee6eac3ca100f82ebfaf606

\??\c:\Users\Admin\AppData\Local\Temp\e4kkd2dn\CSC61662FF4C9B0495BB172EA3BD7D4D12B.TMP

MD5 2f363ea342881632ef4f475e350fc0e3
SHA1 19a6d670dad5e61ad81c3f55068a1c21ff297a98
SHA256 f9e5fc542c2bcdcc6cd69102f9e8bffd3cb3705214906cd4459333f7b188ef54
SHA512 2ae071809da5706c0d8ba0ec9048eba31e15accd82b38533ae7ba44dc7ee23a852625419c0f812e0310ead4c9b2948e5e7b7a0d215db0a22129b8951bb0010a2

C:\Users\Admin\AppData\Local\Temp\RES3A62.tmp

MD5 cd981be58bbf084a5b1452f8718a6910
SHA1 a0d735ae448f24be46bcde3c6994e3fd854732a9
SHA256 f26d59f15ff2428052c4d3411f18840f46d2350c041a82ddefc9804689fe0dd6
SHA512 c13a920ed8f1385db80f7dd1fa79e83b0d430a08ab2688106ab5b3dc1f633ef90802e8fc359769d4f3dabafbc0e88cc7cc31877beaed8ecca99c07f25eda334b

C:\Users\Admin\AppData\Local\Temp\e4kkd2dn\e4kkd2dn.dll

MD5 f5620f634d1d7854cb874d0f0b6c11cd
SHA1 5a18cb30f279c6c1c139e965aba947ba783fba41
SHA256 49cb17fe798c9d7f440aa06eee99b9f91f473837aa9b3ef07bbbe0be674cccab
SHA512 12060cf50de759671dcf5e876fcca1f9b2bddf8d7d2cd9b581e8d88e0dcad58111eae7a53ff46cf42656f523bb9337f4337a4fa73adafaeaf71a90689d943ee1

memory/2640-214-0x0000000004DB0000-0x0000000004F10000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\4yysp0pf\4yysp0pf.cmdline

MD5 bd816539ddf10347c61cc6cf8178f336
SHA1 b52d8f80375c659c69677ee255eb37a43655ccaa
SHA256 8572ce0488390115ae9fe1b96882b95b52a8c97adb9a0c7f0efb3c2752e6ac16
SHA512 ca31977708b08b1eaac4e9d6789f78d4c3827d91c983733abc3ac698e9eb41f35d19af09730a19c6fac02fc9fc4be47421636ae3808469ba5c24deab607543ec

\??\c:\Users\Admin\AppData\Local\Temp\4yysp0pf\CSC6B854E7BBFA34C0C9C94C35BD92CD662.TMP

MD5 801db19718f69e40eb60bd2513b0e660
SHA1 3bcdd898282c19de66a076ea61c1d1e984c0433f
SHA256 9b0cc758ce5472eafc5bd2fa6fd333b3cfb4eb68eab1fab988be6e0cbe2ba899
SHA512 f9eb44e51085906c4a92e84b4d82475d94c1a327398f90645e9f4fe630994e53e2d7dc40e924da0c2948ed1945a334df0e33c28f88f2a5f8e76c4225a163edfc

C:\Users\Admin\AppData\Local\Temp\RES3CD2.tmp

MD5 656c88b198550ab80957f1dbada1f85d
SHA1 afbfc90f05af7fb814dc4df3948753f1b82fc8bf
SHA256 a76e0baca0fda4332ecb45bf215439848b3438760f0917428c480fef97d61741
SHA512 18f7eba154ccd0546d580681c12e881938e826c9f7ec9b2aef4524e680313b872d313d5fc46e11b422597b4f450783ec1c514ebec4fe3e5980f38fb83dcb99ec

memory/1508-233-0x0000000004E90000-0x0000000004FF0000-memory.dmp

memory/1076-247-0x0000000004610000-0x0000000004770000-memory.dmp

memory/1124-261-0x0000000004DE0000-0x0000000004F40000-memory.dmp

memory/292-275-0x00000000050D0000-0x0000000005230000-memory.dmp

memory/2120-289-0x0000000004E90000-0x0000000004FF0000-memory.dmp

memory/2872-303-0x0000000004D00000-0x0000000004E60000-memory.dmp

memory/376-317-0x0000000004D30000-0x0000000004E90000-memory.dmp

memory/2664-331-0x0000000004860000-0x00000000049C0000-memory.dmp

memory/2060-345-0x0000000004D60000-0x0000000004EC0000-memory.dmp

memory/1984-359-0x0000000004E50000-0x0000000004FB0000-memory.dmp

memory/1508-373-0x0000000004EC0000-0x0000000005020000-memory.dmp

memory/2888-387-0x0000000004D30000-0x0000000004E90000-memory.dmp

memory/1636-401-0x0000000004E60000-0x0000000004FC0000-memory.dmp

memory/1224-415-0x0000000004F30000-0x0000000005090000-memory.dmp

memory/2760-429-0x0000000004CF0000-0x0000000004E50000-memory.dmp

memory/2556-443-0x0000000004D20000-0x0000000004E80000-memory.dmp

memory/760-457-0x0000000004DB0000-0x0000000004F10000-memory.dmp

memory/1252-471-0x0000000004A40000-0x0000000004BA0000-memory.dmp

memory/656-485-0x0000000004E80000-0x0000000004FE0000-memory.dmp

memory/1508-499-0x0000000004EE0000-0x0000000005040000-memory.dmp

memory/336-513-0x00000000048B0000-0x0000000004A10000-memory.dmp

memory/2776-527-0x0000000004F00000-0x0000000005060000-memory.dmp

memory/1860-541-0x0000000004E00000-0x0000000004F60000-memory.dmp

memory/2628-555-0x00000000049B0000-0x0000000004B10000-memory.dmp

memory/1984-569-0x0000000004FA0000-0x0000000005100000-memory.dmp

memory/2472-583-0x0000000004910000-0x0000000004A70000-memory.dmp

memory/2980-597-0x0000000004C90000-0x0000000004DF0000-memory.dmp

memory/812-611-0x0000000004F10000-0x0000000005070000-memory.dmp

memory/844-625-0x0000000004BE0000-0x0000000004D40000-memory.dmp

memory/2796-639-0x0000000004E50000-0x0000000004FB0000-memory.dmp

memory/1528-653-0x0000000004DB0000-0x0000000004F10000-memory.dmp

memory/2316-667-0x0000000004E10000-0x0000000004F70000-memory.dmp

memory/1244-681-0x0000000004E40000-0x0000000004FA0000-memory.dmp

memory/2704-695-0x0000000004CA0000-0x0000000004E00000-memory.dmp

memory/3032-709-0x0000000004DD0000-0x0000000004F30000-memory.dmp

memory/2592-723-0x0000000004800000-0x0000000004960000-memory.dmp

memory/2164-737-0x0000000004DB0000-0x0000000004F10000-memory.dmp

memory/1308-751-0x0000000004D50000-0x0000000004EB0000-memory.dmp

memory/684-765-0x0000000004DA0000-0x0000000004F00000-memory.dmp

memory/344-779-0x0000000004F20000-0x0000000005080000-memory.dmp

memory/3060-793-0x0000000004CF0000-0x0000000004E50000-memory.dmp

memory/1620-807-0x0000000004E80000-0x0000000004FE0000-memory.dmp

memory/1336-821-0x0000000004E50000-0x0000000004FB0000-memory.dmp

memory/1316-835-0x0000000004DA0000-0x0000000004F00000-memory.dmp

memory/2420-849-0x0000000004FB0000-0x0000000005110000-memory.dmp

memory/2404-863-0x0000000004E50000-0x0000000004FB0000-memory.dmp

memory/1300-877-0x0000000004F80000-0x00000000050E0000-memory.dmp

memory/1356-891-0x00000000048E0000-0x0000000004A40000-memory.dmp

memory/2300-905-0x0000000004DD0000-0x0000000004F30000-memory.dmp

memory/1768-919-0x0000000004DF0000-0x0000000004F50000-memory.dmp

memory/628-933-0x0000000004F70000-0x00000000050D0000-memory.dmp

memory/752-947-0x0000000000CC0000-0x0000000000E20000-memory.dmp

memory/1616-961-0x0000000004D70000-0x0000000004ED0000-memory.dmp

memory/2088-975-0x0000000004DB0000-0x0000000004F10000-memory.dmp

memory/2320-989-0x0000000004E50000-0x0000000004FB0000-memory.dmp

memory/2704-1003-0x0000000004E10000-0x0000000004F70000-memory.dmp

memory/568-1017-0x0000000004DF0000-0x0000000004F50000-memory.dmp

memory/1432-1031-0x0000000004E50000-0x0000000004FB0000-memory.dmp

memory/1644-1045-0x00000000045F0000-0x0000000004750000-memory.dmp

memory/2232-1059-0x0000000004870000-0x00000000049D0000-memory.dmp

memory/2652-1073-0x0000000004F80000-0x00000000050E0000-memory.dmp

memory/2124-1087-0x0000000004DC0000-0x0000000004F20000-memory.dmp

memory/1592-1101-0x0000000004C40000-0x0000000004DA0000-memory.dmp

memory/2368-1115-0x0000000004DF0000-0x0000000004F50000-memory.dmp

memory/2864-1129-0x0000000004A10000-0x0000000004B70000-memory.dmp

memory/1768-1143-0x0000000004DE0000-0x0000000004F40000-memory.dmp

memory/1784-1157-0x0000000004F60000-0x00000000050C0000-memory.dmp

memory/868-1171-0x0000000004FC0000-0x0000000005120000-memory.dmp

memory/2060-1185-0x0000000004CC0000-0x0000000004E20000-memory.dmp

memory/1076-1199-0x0000000004FA0000-0x0000000005100000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 02:23

Reported

2024-05-19 02:25

Platform

win10v2004-20240426-en

Max time kernel

129s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 968 set thread context of 2212 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3956 set thread context of 4944 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3316 set thread context of 860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2584 set thread context of 4408 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3952 set thread context of 2084 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1476 set thread context of 3356 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3512 set thread context of 5024 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1876 set thread context of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2216 set thread context of 4544 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5092 set thread context of 4564 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2232 set thread context of 2116 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 set thread context of 4964 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2268 set thread context of 3316 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4468 set thread context of 4220 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3092 set thread context of 2100 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3000 set thread context of 1628 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3612 set thread context of 4936 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 628 set thread context of 4996 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4816 set thread context of 3632 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4292 set thread context of 3268 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4476 set thread context of 4056 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1536 set thread context of 2952 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3572 set thread context of 5064 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 880 set thread context of 348 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2240 set thread context of 4964 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 set thread context of 4368 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1920 set thread context of 3664 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1476 set thread context of 1388 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2948 set thread context of 4836 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4816 set thread context of 1624 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1572 set thread context of 4684 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1412 set thread context of 2992 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3768 set thread context of 1668 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 4180 set thread context of 2860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2392 set thread context of 2272 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4408 set thread context of 4816 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\System32\Conhost.exe
PID 3164 set thread context of 4456 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 set thread context of 3216 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 4940 set thread context of 452 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4576 set thread context of 3780 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3208 set thread context of 2652 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4132 set thread context of 3776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4480 set thread context of 4288 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3164 set thread context of 2028 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1388 set thread context of 2784 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1668 set thread context of 628 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 916 set thread context of 3208 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 348 set thread context of 4888 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 set thread context of 2408 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4860 set thread context of 4608 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3216 set thread context of 940 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4956 set thread context of 1752 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4528 set thread context of 1616 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4212 set thread context of 4340 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4380 set thread context of 3392 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2120 set thread context of 4836 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1744 set thread context of 1536 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1948 set thread context of 4896 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2232 set thread context of 1280 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3268 set thread context of 2140 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4080 set thread context of 2508 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4596 set thread context of 3284 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4816 set thread context of 3776 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\System32\Conhost.exe
PID 4604 set thread context of 3648 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\UDP Subsystem\udpss.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 968 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 968 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 968 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 852 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 852 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 852 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 968 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 968 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 968 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 968 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3956 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3956 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3956 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3360 wrote to memory of 4580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3360 wrote to memory of 4580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3360 wrote to memory of 4580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3956 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3956 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3956 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3956 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3956 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3956 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3956 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3316 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3316 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3316 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4936 wrote to memory of 216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4936 wrote to memory of 216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4936 wrote to memory of 216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3316 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3316 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3316 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3316 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3316 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3316 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3316 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2584 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2584 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2584 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 688 wrote to memory of 3164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 688 wrote to memory of 3164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 688 wrote to memory of 3164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2584 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2584 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2584 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2584 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2584 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2584 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 2584 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe
PID 3952 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3952 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3952 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4044 wrote to memory of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4044 wrote to memory of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4044 wrote to memory of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rqhy0ptp\rqhy0ptp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A0B.tmp" "c:\Users\Admin\AppData\Local\Temp\rqhy0ptp\CSCF98CCD98972243AF9FB622D9C719E4FA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hln53l0j\hln53l0j.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DF3.tmp" "c:\Users\Admin\AppData\Local\Temp\hln53l0j\CSC6C51C2501E00461CA528EAA1B5C04354.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xld1rxff\xld1rxff.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4277.tmp" "c:\Users\Admin\AppData\Local\Temp\xld1rxff\CSCB993B09E25494F8891E48CF44B92E46.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ws32qa0x\ws32qa0x.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44D9.tmp" "c:\Users\Admin\AppData\Local\Temp\ws32qa0x\CSC30474657ECE64B4D9DFB174DE96FEF3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nt4rfssw\nt4rfssw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47A8.tmp" "c:\Users\Admin\AppData\Local\Temp\nt4rfssw\CSCD4450F33C315410A988C6DC38993C53A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\whvnyzja\whvnyzja.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49CA.tmp" "c:\Users\Admin\AppData\Local\Temp\whvnyzja\CSC2D7704EF9BE7489595AC4EC0467A9D25.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ig0wdkp4\ig0wdkp4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C3B.tmp" "c:\Users\Admin\AppData\Local\Temp\ig0wdkp4\CSC35B08EC31C1E4701AB73FF67CE43CBBD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rfiukjab\rfiukjab.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E6E.tmp" "c:\Users\Admin\AppData\Local\Temp\rfiukjab\CSCE776E22483D142AFAA988A69CDE85FD9.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mi2j5pgt\mi2j5pgt.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50DF.tmp" "c:\Users\Admin\AppData\Local\Temp\mi2j5pgt\CSCDA2B4E043DEB4A8AA13AB99E9AC2CC9A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ydtzvd5f\ydtzvd5f.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES539E.tmp" "c:\Users\Admin\AppData\Local\Temp\ydtzvd5f\CSCA3B95EC1414342CF93D333E86E667E32.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ikalb1mi\ikalb1mi.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES562E.tmp" "c:\Users\Admin\AppData\Local\Temp\ikalb1mi\CSCAE7B279BBBB04FEB9B9ACEAD2DE5E5D2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwy3rqyf\bwy3rqyf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5832.tmp" "c:\Users\Admin\AppData\Local\Temp\bwy3rqyf\CSC6D474D4266A4BB8A2A3C0526E704D2F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\erwwhcmz\erwwhcmz.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A45.tmp" "c:\Users\Admin\AppData\Local\Temp\erwwhcmz\CSC240193046C784CF9A6556C4C25B49BD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3fr3pwmk\3fr3pwmk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C49.tmp" "c:\Users\Admin\AppData\Local\Temp\3fr3pwmk\CSC791A7B5995174029B4EB53AC722EA3BB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0o4bzhvd\0o4bzhvd.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EE9.tmp" "c:\Users\Admin\AppData\Local\Temp\0o4bzhvd\CSC62A58921BB2647ED85B131989CA33AFE.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z5s5oozj\z5s5oozj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES613A.tmp" "c:\Users\Admin\AppData\Local\Temp\z5s5oozj\CSC1A8939B9A12403E804E68DC615799F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\njcmpka1\njcmpka1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES633E.tmp" "c:\Users\Admin\AppData\Local\Temp\njcmpka1\CSC6FAA8FFE83F647A0A0625383999EBB91.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hzeagcel\hzeagcel.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6561.tmp" "c:\Users\Admin\AppData\Local\Temp\hzeagcel\CSCEDBFEED0E68145E698BF6BBAF29BEF68.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0fya40rp\0fya40rp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6755.tmp" "c:\Users\Admin\AppData\Local\Temp\0fya40rp\CSC197DECB758ED4B4AB59BC830F0522D3C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1km5nk0b\1km5nk0b.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6978.tmp" "c:\Users\Admin\AppData\Local\Temp\1km5nk0b\CSC77E5C91CBE0D4699BF82F07EA1EF61D5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dn0cnntr\dn0cnntr.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BBA.tmp" "c:\Users\Admin\AppData\Local\Temp\dn0cnntr\CSC122A6DBA96874AB78DB32FE17327DD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qbziiv11\qbziiv11.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DDD.tmp" "c:\Users\Admin\AppData\Local\Temp\qbziiv11\CSC195CAF4D7F6842EBB83BCDDA8D867ECB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2olmd5dl\2olmd5dl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FF0.tmp" "c:\Users\Admin\AppData\Local\Temp\2olmd5dl\CSCBE8E767C3874550A78F71B646523CF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wycge2fm\wycge2fm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71E4.tmp" "c:\Users\Admin\AppData\Local\Temp\wycge2fm\CSC513C9AB3F8A64A1B8A10C4EF119BD92.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgehmwdx\dgehmwdx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73B9.tmp" "c:\Users\Admin\AppData\Local\Temp\dgehmwdx\CSC365676DE3A54704A55B34D52994D36D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iywcy5tg\iywcy5tg.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75FB.tmp" "c:\Users\Admin\AppData\Local\Temp\iywcy5tg\CSCB9A9B20128E549998DC07DA8BE8629F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z0mn44cg\z0mn44cg.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78D9.tmp" "c:\Users\Admin\AppData\Local\Temp\z0mn44cg\CSCD56C290CB74C4CA88E841CC5DDE39E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c2il2rxw\c2il2rxw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B2B.tmp" "c:\Users\Admin\AppData\Local\Temp\c2il2rxw\CSCC03275FDCA9941FE8274F2D5ACB0ABD4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xyl0tob1\xyl0tob1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E48.tmp" "c:\Users\Admin\AppData\Local\Temp\xyl0tob1\CSCDFAF176918A49B08BE79C3FF41427C5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pf0rpu1t\pf0rpu1t.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8107.tmp" "c:\Users\Admin\AppData\Local\Temp\pf0rpu1t\CSC97049DDF1CD94A0D985E861F27A649A7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\og3xe0ol\og3xe0ol.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8378.tmp" "c:\Users\Admin\AppData\Local\Temp\og3xe0ol\CSC6AD73DDEF4A4420CB682CFFE296CEE.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r2lubpqi\r2lubpqi.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8676.tmp" "c:\Users\Admin\AppData\Local\Temp\r2lubpqi\CSC1AF0ED6A6F844C348DEDA9992F13F1D1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\np0iyarr\np0iyarr.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8954.tmp" "c:\Users\Admin\AppData\Local\Temp\np0iyarr\CSC1408E5796DB4168A0BF80E978B94B60.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\13esyvdr\13esyvdr.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C32.tmp" "c:\Users\Admin\AppData\Local\Temp\13esyvdr\CSC422063B62052427297BA8779DCCD4F74.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vjacchjl\vjacchjl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EA3.tmp" "c:\Users\Admin\AppData\Local\Temp\vjacchjl\CSC1B2616AF92E74849BD651179561E40E1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\augbdsrh\augbdsrh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9163.tmp" "c:\Users\Admin\AppData\Local\Temp\augbdsrh\CSC47F923EDBF784B3294D1B32164C73956.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ow5kyevl\ow5kyevl.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9460.tmp" "c:\Users\Admin\AppData\Local\Temp\ow5kyevl\CSCF2B5CCDFB70B4E84B756ACB1EC1DD43C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2f0iotzy\2f0iotzy.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES976D.tmp" "c:\Users\Admin\AppData\Local\Temp\2f0iotzy\CSC1A4CE1019DF4B97BB4AD7653A7BC545.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zszy3qnh\zszy3qnh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A2D.tmp" "c:\Users\Admin\AppData\Local\Temp\zszy3qnh\CSC1E6E54191F74C818C4CD0A5901FF7BB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vxfmqp4x\vxfmqp4x.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D0B.tmp" "c:\Users\Admin\AppData\Local\Temp\vxfmqp4x\CSC6F56E4FBE9AA4204BCB8FB8B7EB987F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dts1oo4i\dts1oo4i.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F8C.tmp" "c:\Users\Admin\AppData\Local\Temp\dts1oo4i\CSC8E5B9DC332B498FBDF4C05957D4EDB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zndi5une\zndi5une.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2C8.tmp" "c:\Users\Admin\AppData\Local\Temp\zndi5une\CSCDC807E57BA1C4C65A465AFF8C14543D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bbpranda\bbpranda.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5D5.tmp" "c:\Users\Admin\AppData\Local\Temp\bbpranda\CSC7485AE13AFAB4EB89BE88A15BD4A1DC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qqsw4awm\qqsw4awm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA8A4.tmp" "c:\Users\Admin\AppData\Local\Temp\qqsw4awm\CSC81D36D5B23E4461D97B369CC5CEFFF20.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3kbhhuzf\3kbhhuzf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB53.tmp" "c:\Users\Admin\AppData\Local\Temp\3kbhhuzf\CSC28FB3C8D836F4DA292A195144B23A933.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\System32\sihclient.exe

C:\Windows\System32\sihclient.exe /cv PfraIVXHFEasDA0SpJb5Qw.0.2

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hldzamef\hldzamef.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADE3.tmp" "c:\Users\Admin\AppData\Local\Temp\hldzamef\CSCBEE320F7B211464684AF6FB61CF8F966.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jneawdoo\jneawdoo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB016.tmp" "c:\Users\Admin\AppData\Local\Temp\jneawdoo\CSC482E89DCDEA648C0A327913238669F3F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fp1cv1ki\fp1cv1ki.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2F4.tmp" "c:\Users\Admin\AppData\Local\Temp\fp1cv1ki\CSC22794822894543F8837B3312DDFCF7A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qsltfjnu\qsltfjnu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5B3.tmp" "c:\Users\Admin\AppData\Local\Temp\qsltfjnu\CSCF709B3AB523B4DC8BDD56AEBFB7260C4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r4kagckn\r4kagckn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB892.tmp" "c:\Users\Admin\AppData\Local\Temp\r4kagckn\CSC9416413F22F740ACA982CEC7B5CA1A6C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aa4c5b40\aa4c5b40.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB12.tmp" "c:\Users\Admin\AppData\Local\Temp\aa4c5b40\CSC71FE7D7F54274194864BB96ABFC697D6.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oaa45jel\oaa45jel.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD2.tmp" "c:\Users\Admin\AppData\Local\Temp\oaa45jel\CSC5B94240E6C61416D839814CDF0AE8A79.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hospmcnm\hospmcnm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC071.tmp" "c:\Users\Admin\AppData\Local\Temp\hospmcnm\CSC72181781A2E64D3B99F51ED63180A6A3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\idkbug0c\idkbug0c.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC321.tmp" "c:\Users\Admin\AppData\Local\Temp\idkbug0c\CSC8D5E8A144A3F43779291CC11D617DE4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n1irwbi4\n1irwbi4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC592.tmp" "c:\Users\Admin\AppData\Local\Temp\n1irwbi4\CSC7EFC208D4E7349E19594BE774E8689CA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\npmhhz1i\npmhhz1i.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC870.tmp" "c:\Users\Admin\AppData\Local\Temp\npmhhz1i\CSC5A1B4C2EC91B4C95B00959BBB378862.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jwdfayyq\jwdfayyq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB01.tmp" "c:\Users\Admin\AppData\Local\Temp\jwdfayyq\CSC663B6606F884445595B2EFCB81EDA3B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hhrgc2c1\hhrgc2c1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDB0.tmp" "c:\Users\Admin\AppData\Local\Temp\hhrgc2c1\CSC40965F90C9A64161AEB85FE988FA75CA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ws4jwoqm\ws4jwoqm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD07F.tmp" "c:\Users\Admin\AppData\Local\Temp\ws4jwoqm\CSCAED8600E994D4E6BB754D4F2DECB343D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfcbks1l\mfcbks1l.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2E0.tmp" "c:\Users\Admin\AppData\Local\Temp\mfcbks1l\CSC2B01866C18004AF0863D39ECF7F4D7C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ou4zrlun\ou4zrlun.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5CE.tmp" "c:\Users\Admin\AppData\Local\Temp\ou4zrlun\CSC80DCDF5397FB410A9D97C75AF8EBB37F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0oszax5u\0oszax5u.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8BC.tmp" "c:\Users\Admin\AppData\Local\Temp\0oszax5u\CSCE08B8CF1B72341BF8A3145A48F8C28EB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mwtmxsjh\mwtmxsjh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB6C.tmp" "c:\Users\Admin\AppData\Local\Temp\mwtmxsjh\CSC6DC897434144A97984D5E3896951CC3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5mhlv0kq\5mhlv0kq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDEC.tmp" "c:\Users\Admin\AppData\Local\Temp\5mhlv0kq\CSC2799131678074B2F9B4BC45B199FA5FF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ktegaxzu\ktegaxzu.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0CB.tmp" "c:\Users\Admin\AppData\Local\Temp\ktegaxzu\CSC9C7E6DAADF164246B425BAA0BCBDC570.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t0taro53\t0taro53.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE30D.tmp" "c:\Users\Admin\AppData\Local\Temp\t0taro53\CSCD50B6BEBC29B42AEAB12B9BF2820924A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lvcokesu\lvcokesu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE520.tmp" "c:\Users\Admin\AppData\Local\Temp\lvcokesu\CSC9154EB6D343A44D99F2409ED59E886E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\agcxfk2y\agcxfk2y.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE753.tmp" "c:\Users\Admin\AppData\Local\Temp\agcxfk2y\CSCD0C35767D3E4B8390A0A567B1C5456.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rlaeu2cs\rlaeu2cs.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE975.tmp" "c:\Users\Admin\AppData\Local\Temp\rlaeu2cs\CSCB5D43055C2A846AF997B72BE1D851581.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3zdziwbc\3zdziwbc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBE6.tmp" "c:\Users\Admin\AppData\Local\Temp\3zdziwbc\CSC928CAC627E374E3AA34DF2FEE23BF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iscvi2am\iscvi2am.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEA6.tmp" "c:\Users\Admin\AppData\Local\Temp\iscvi2am\CSC9EC2FD15A36244A288343453186F767F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p3aximcj\p3aximcj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF155.tmp" "c:\Users\Admin\AppData\Local\Temp\p3aximcj\CSC3E5742A2D21C455F9C6296853C14ACF3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\32a135td\32a135td.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF433.tmp" "c:\Users\Admin\AppData\Local\Temp\32a135td\CSC616F07127BD045FFA2DEF1E2366B54C7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pk5tf4bt\pk5tf4bt.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF731.tmp" "c:\Users\Admin\AppData\Local\Temp\pk5tf4bt\CSC2066CF15DD34D8494DABEB24DEBDA6.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pekdxvbs\pekdxvbs.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA3E.tmp" "c:\Users\Admin\AppData\Local\Temp\pekdxvbs\CSCAB7F7EEB637B4159A9F5C37CDD375CC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\apdlqhjq\apdlqhjq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD0D.tmp" "c:\Users\Admin\AppData\Local\Temp\apdlqhjq\CSCED380347D109423B9524CD9F76671CE8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\frajk21j\frajk21j.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF4F.tmp" "c:\Users\Admin\AppData\Local\Temp\frajk21j\CSCF19BE18AF62047A18A64D3A99E157094.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ila5lj20\ila5lj20.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EF.tmp" "c:\Users\Admin\AppData\Local\Temp\ila5lj20\CSC1C64D190670043F18820EF9A13DCA54.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h3vmoxvu\h3vmoxvu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES470.tmp" "c:\Users\Admin\AppData\Local\Temp\h3vmoxvu\CSCC8D0C48C990049D58CDA9E7DCACEF814.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mqzn0t4y\mqzn0t4y.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74E.tmp" "c:\Users\Admin\AppData\Local\Temp\mqzn0t4y\CSCDAD4BE4C8E364F27AD33BADD3ECD6C16.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2pqw1zbr\2pqw1zbr.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB9.tmp" "c:\Users\Admin\AppData\Local\Temp\2pqw1zbr\CSCCE4D33FCD8994018893C99FB4F923724.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bxubfmeo\bxubfmeo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2A.tmp" "c:\Users\Admin\AppData\Local\Temp\bxubfmeo\CSCB3CE6978887245DE9DF82D2C3C565B4E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bsxek0ry\bsxek0ry.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10B4.tmp" "c:\Users\Admin\AppData\Local\Temp\bsxek0ry\CSC7230236855424E1887AA5129FFFCB80.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\io5yghxy\io5yghxy.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1410.tmp" "c:\Users\Admin\AppData\Local\Temp\io5yghxy\CSC1039FFD3106146868425598A5B7F237D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ismm14tk\ismm14tk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES172D.tmp" "c:\Users\Admin\AppData\Local\Temp\ismm14tk\CSCD874632232A9426B889730BE9C95BF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5od0tzmp\5od0tzmp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A2A.tmp" "c:\Users\Admin\AppData\Local\Temp\5od0tzmp\CSC199BD02498AF477D9640141341737F49.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xcxlke1s\xcxlke1s.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CE9.tmp" "c:\Users\Admin\AppData\Local\Temp\xcxlke1s\CSC42F41589C3984992A632A0D765BF8867.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nh3liqf2\nh3liqf2.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FB8.tmp" "c:\Users\Admin\AppData\Local\Temp\nh3liqf2\CSC490AD52030114033AED7326DA98BDB3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\24khquyd\24khquyd.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22C5.tmp" "c:\Users\Admin\AppData\Local\Temp\24khquyd\CSCC3671A7B8F25400D97B0A424CBB368B3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dwy2rloz\dwy2rloz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2565.tmp" "c:\Users\Admin\AppData\Local\Temp\dwy2rloz\CSC40BA15E73C05437AA090B2B43CDB1C7D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dvoqegk2\dvoqegk2.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2798.tmp" "c:\Users\Admin\AppData\Local\Temp\dvoqegk2\CSC8141C05931C24C9F972495F6BAD046B7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cshcq31j\cshcq31j.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A38.tmp" "c:\Users\Admin\AppData\Local\Temp\cshcq31j\CSCF392AB1D89614093A9AF1695861DC81B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dyejw5j4\dyejw5j4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CE7.tmp" "c:\Users\Admin\AppData\Local\Temp\dyejw5j4\CSCC5F2C0088A89480DBC44F7D2A1612483.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fzyaupgu\fzyaupgu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3004.tmp" "c:\Users\Admin\AppData\Local\Temp\fzyaupgu\CSC8FF5602F4F9F470CB554FFA150A2A8D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b0lrxeqa\b0lrxeqa.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32B3.tmp" "c:\Users\Admin\AppData\Local\Temp\b0lrxeqa\CSC65BF89D4F384B14B5E371B314CEF7B5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hanxpswn\hanxpswn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3534.tmp" "c:\Users\Admin\AppData\Local\Temp\hanxpswn\CSCF4A418FFAD3B490F9F4B6D5C82501E45.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gb1nba2e\gb1nba2e.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37A5.tmp" "c:\Users\Admin\AppData\Local\Temp\gb1nba2e\CSCC0A76014D230417AAD3A327489D6551A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hyjchyxh\hyjchyxh.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A55.tmp" "c:\Users\Admin\AppData\Local\Temp\hyjchyxh\CSCD069EDEE5A4A4C8E89A5116D5C5C3067.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3uis3m2v\3uis3m2v.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CC6.tmp" "c:\Users\Admin\AppData\Local\Temp\3uis3m2v\CSCB193C99DC53B490FA4FCB32A13BB845A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kyzib2ca\kyzib2ca.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FB4.tmp" "c:\Users\Admin\AppData\Local\Temp\kyzib2ca\CSC1DFA46E7D18D4C119A912113F526D88.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1tf21ul\x1tf21ul.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4263.tmp" "c:\Users\Admin\AppData\Local\Temp\x1tf21ul\CSCE8E6D1D432AF45DFB678D16DD8A42D43.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dncamgtq\dncamgtq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44F3.tmp" "c:\Users\Admin\AppData\Local\Temp\dncamgtq\CSC100C34983734393865697C5EFA8362.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ek2ykmaq\ek2ykmaq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4774.tmp" "c:\Users\Admin\AppData\Local\Temp\ek2ykmaq\CSC876BF0446F7547A898169342CC2C83D3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t2a1ld5p\t2a1ld5p.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A62.tmp" "c:\Users\Admin\AppData\Local\Temp\t2a1ld5p\CSCCA0CC1023C044356A8F34F1C3E45646C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j4rmoglz\j4rmoglz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DAE.tmp" "c:\Users\Admin\AppData\Local\Temp\j4rmoglz\CSC51F694B089EC44D3A51AC1C356455B0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kauprksf\kauprksf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FD1.tmp" "c:\Users\Admin\AppData\Local\Temp\kauprksf\CSC8BB6CDAAE94B461CB4B13E9F7A24161F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hfx2cbc1\hfx2cbc1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52AF.tmp" "c:\Users\Admin\AppData\Local\Temp\hfx2cbc1\CSCCE885D0A5908486581ECFDE9886E32D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lwvsa0hx\lwvsa0hx.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES554F.tmp" "c:\Users\Admin\AppData\Local\Temp\lwvsa0hx\CSC8A5FB17DAFD04F178FFEE7CE978053E4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b4l1xwfz\b4l1xwfz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57FE.tmp" "c:\Users\Admin\AppData\Local\Temp\b4l1xwfz\CSC71A260CF1E7E4336B8EF6FA93A66A521.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eazxjw1j\eazxjw1j.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A40.tmp" "c:\Users\Admin\AppData\Local\Temp\eazxjw1j\CSCAF4D686A61E24B9AA7C0AA8E5235552.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l4bp2euk\l4bp2euk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D00.tmp" "c:\Users\Admin\AppData\Local\Temp\l4bp2euk\CSCD19E9F53E88A4C649396E950A4808248.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qs40uqse\qs40uqse.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F51.tmp" "c:\Users\Admin\AppData\Local\Temp\qs40uqse\CSCA55565E035F84F3B919177688465FC39.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ym4g40ax\ym4g40ax.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61B3.tmp" "c:\Users\Admin\AppData\Local\Temp\ym4g40ax\CSC88A8ACDD90DA4E49978982F19E197392.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wcfvrcyu\wcfvrcyu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6453.tmp" "c:\Users\Admin\AppData\Local\Temp\wcfvrcyu\CSC7A53103D50234A80A99396F925CDD220.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lhxqk5jo\lhxqk5jo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6712.tmp" "c:\Users\Admin\AppData\Local\Temp\lhxqk5jo\CSCB6269A1724F495EB8C7E845D639DAA4.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xugknw3\0xugknw3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69A2.tmp" "c:\Users\Admin\AppData\Local\Temp\0xugknw3\CSC310C46433C24C92A5CEC97DC940A153.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kku0j04l\kku0j04l.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C42.tmp" "c:\Users\Admin\AppData\Local\Temp\kku0j04l\CSC83E89DB17D514448916FC64375F955F0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xs50lra4\xs50lra4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EA3.tmp" "c:\Users\Admin\AppData\Local\Temp\xs50lra4\CSCEE9925E1300740CC9793DF737DA741A6.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\we5pmayx\we5pmayx.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7097.tmp" "c:\Users\Admin\AppData\Local\Temp\we5pmayx\CSCD7502EEDC134C9AB786ED1C3B6E5665.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wlxu0zlq\wlxu0zlq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72D9.tmp" "c:\Users\Admin\AppData\Local\Temp\wlxu0zlq\CSC89B7B0E08DE34313B74335DD8C928C15.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\agvugzij\agvugzij.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES750C.tmp" "c:\Users\Admin\AppData\Local\Temp\agvugzij\CSCCAB39B99C79644B78BAE7F0A59679FB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u54owshj\u54owshj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES775E.tmp" "c:\Users\Admin\AppData\Local\Temp\u54owshj\CSCC0F659CFC73842D79B9DD534B9577990.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3avd2viw\3avd2viw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES79CF.tmp" "c:\Users\Admin\AppData\Local\Temp\3avd2viw\CSC8483523F32704FFF9CB31733B41C4E5D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a3v4n1fk\a3v4n1fk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CAD.tmp" "c:\Users\Admin\AppData\Local\Temp\a3v4n1fk\CSC8A3F54A38AD44F65A340BDE5FDAD14B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvzf2ywr\yvzf2ywr.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F3D.tmp" "c:\Users\Admin\AppData\Local\Temp\yvzf2ywr\CSC7D40D4C96ADE42409B8064AC20C7E8D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\txioz0ob\txioz0ob.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES824A.tmp" "c:\Users\Admin\AppData\Local\Temp\txioz0ob\CSCFC1DC15422D14EC1884718CE70EB9526.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ezhayu3z\ezhayu3z.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84EA.tmp" "c:\Users\Admin\AppData\Local\Temp\ezhayu3z\CSCCE38F7DA742B4A27904FB3CC7FF19B61.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u0rcmzll\u0rcmzll.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8836.tmp" "c:\Users\Admin\AppData\Local\Temp\u0rcmzll\CSCEE3217BAA624FBC8916CB515D8F85E9.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1nvxwdjd\1nvxwdjd.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B34.tmp" "c:\Users\Admin\AppData\Local\Temp\1nvxwdjd\CSCDFB1FBB31B3041F8BC102BB8B06A24D3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qm22gxqf\qm22gxqf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E22.tmp" "c:\Users\Admin\AppData\Local\Temp\qm22gxqf\CSC27D85250EEE4411E8BBBF6181E8822E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a40lds2f\a40lds2f.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES913F.tmp" "c:\Users\Admin\AppData\Local\Temp\a40lds2f\CSCAD4696D3390C483487C29AA2C4641999.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qx4srbq\2qx4srbq.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES942D.tmp" "c:\Users\Admin\AppData\Local\Temp\2qx4srbq\CSCF0E75EE8B5B9498C84A2FA8041D97086.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yb2gklwy\yb2gklwy.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96DC.tmp" "c:\Users\Admin\AppData\Local\Temp\yb2gklwy\CSC91130ABFEB6A46BFB148C06726B1C21D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\31mq5omz\31mq5omz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES993D.tmp" "c:\Users\Admin\AppData\Local\Temp\31mq5omz\CSCF3CFDAF71A1F48B286B02D66EDFA5925.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1wfl3pkq\1wfl3pkq.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BED.tmp" "c:\Users\Admin\AppData\Local\Temp\1wfl3pkq\CSC758A63B1F32B4C37B9611B2F7C79E168.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jhp5vafj\jhp5vafj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EDB.tmp" "c:\Users\Admin\AppData\Local\Temp\jhp5vafj\CSCA4AB1DE855C0439CBB1A7129596F3521.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\syo5jgxa\syo5jgxa.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA19A.tmp" "c:\Users\Admin\AppData\Local\Temp\syo5jgxa\CSC68E01184B7604760B6EAFC83F91F324E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rpnb00mu\rpnb00mu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA459.tmp" "c:\Users\Admin\AppData\Local\Temp\rpnb00mu\CSC601E27BFCEE34A7D9BC37E5DEDDED5C0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rxhq4b5c\rxhq4b5c.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA786.tmp" "c:\Users\Admin\AppData\Local\Temp\rxhq4b5c\CSC17B33FB01A8C4DD1BD13ABDF884EA1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ov4womf5\ov4womf5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9F7.tmp" "c:\Users\Admin\AppData\Local\Temp\ov4womf5\CSCFC8CE96426BA460DB4E8F4EA678E4C7D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i42pr4jo\i42pr4jo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC87.tmp" "c:\Users\Admin\AppData\Local\Temp\i42pr4jo\CSC71E212D034A74349AAB2D7D91224CC89.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0upuklba\0upuklba.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEF8.tmp" "c:\Users\Admin\AppData\Local\Temp\0upuklba\CSC38543728BF9F456C8454EDF93C97950.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ffp2tzev\ffp2tzev.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB215.tmp" "c:\Users\Admin\AppData\Local\Temp\ffp2tzev\CSCC671C6413AE24E7DB99E7FC531374874.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mo1ezvkp\mo1ezvkp.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4E4.tmp" "c:\Users\Admin\AppData\Local\Temp\mo1ezvkp\CSC5FBC95A5D28345D5AA1B43F21BF77968.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\huhd0kts\huhd0kts.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7A3.tmp" "c:\Users\Admin\AppData\Local\Temp\huhd0kts\CSC4712FED9575740879D9DD94A10E37F2B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r24luz04\r24luz04.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA71.tmp" "c:\Users\Admin\AppData\Local\Temp\r24luz04\CSCF12755F5EDDD476683A74BCCD6D48146.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\loteytgc\loteytgc.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD9E.tmp" "c:\Users\Admin\AppData\Local\Temp\loteytgc\CSC828FB829639B42A5ADE6804732A82AD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kg3nfmmc\kg3nfmmc.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC05D.tmp" "c:\Users\Admin\AppData\Local\Temp\kg3nfmmc\CSC85D3D3228CEE487EA86C50AD7FE5ED.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jatkb0rx\jatkb0rx.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC36A.tmp" "c:\Users\Admin\AppData\Local\Temp\jatkb0rx\CSCD99D5924C285476AA3CE6393067C811.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hz4z3qof\hz4z3qof.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC60A.tmp" "c:\Users\Admin\AppData\Local\Temp\hz4z3qof\CSC1227010C5E1D4CCEB4278660B8737A4D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\udw1ldqd\udw1ldqd.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8F8.tmp" "c:\Users\Admin\AppData\Local\Temp\udw1ldqd\CSC96F66DCB911A4087AF51FD6BB2F0CED7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4u5tdmyd\4u5tdmyd.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB79.tmp" "c:\Users\Admin\AppData\Local\Temp\4u5tdmyd\CSCBF971B2DFE1443B7B992C4A427A0AD38.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zxzumsvt\zxzumsvt.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE38.tmp" "c:\Users\Admin\AppData\Local\Temp\zxzumsvt\CSCC6DBF74227B543A0A92A3487AC61CAAE.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\303djiqz\303djiqz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD099.tmp" "c:\Users\Admin\AppData\Local\Temp\303djiqz\CSC149BB119BA184B0D886F93C2764F8E46.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uw0ayfwc\uw0ayfwc.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD378.tmp" "c:\Users\Admin\AppData\Local\Temp\uw0ayfwc\CSCAFE2880488074B25978370EB3C85492A.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0wvq5h1p\0wvq5h1p.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD627.tmp" "c:\Users\Admin\AppData\Local\Temp\0wvq5h1p\CSC21576221EF5948D3934036BC356F8F1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\um1n5ica\um1n5ica.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD934.tmp" "c:\Users\Admin\AppData\Local\Temp\um1n5ica\CSC87DB183BCA33453D839A91F5E1FF7C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\juylmzg4\juylmzg4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC03.tmp" "c:\Users\Admin\AppData\Local\Temp\juylmzg4\CSC89746A1E7BFE43678A4C574F1467F7BC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hrvrocwn\hrvrocwn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEA3.tmp" "c:\Users\Admin\AppData\Local\Temp\hrvrocwn\CSC768B6CCF68554B67BEB6136FFBB9E7AC.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qk3p3rw5\qk3p3rw5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE133.tmp" "c:\Users\Admin\AppData\Local\Temp\qk3p3rw5\CSC9FAE3F3CC03C4A59872A54ADD2A82867.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\npeb0stn\npeb0stn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3D3.tmp" "c:\Users\Admin\AppData\Local\Temp\npeb0stn\CSCE89B3EDB09542E8B13B858E711DF74.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\04qpi53t\04qpi53t.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6D1.tmp" "c:\Users\Admin\AppData\Local\Temp\04qpi53t\CSCB1566EC0E128413F8B5E4A045B4140.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d4r0k0zu\d4r0k0zu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE961.tmp" "c:\Users\Admin\AppData\Local\Temp\d4r0k0zu\CSC48EF60C4F5334B1FA5C9EB6416343AA1.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b01o4iux\b01o4iux.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC5F.tmp" "c:\Users\Admin\AppData\Local\Temp\b01o4iux\CSCFC14DE039FE844668323D04CE74FF24D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4dqq3wnh\4dqq3wnh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF008.tmp" "c:\Users\Admin\AppData\Local\Temp\4dqq3wnh\CSC2C274BF48BB74BF4BAC3734787BA367F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yjvouahz\yjvouahz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF20C.tmp" "c:\Users\Admin\AppData\Local\Temp\yjvouahz\CSC9D80BF30AFF44E2493441E8F98F75444.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cg3wmrcz\cg3wmrcz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF42F.tmp" "c:\Users\Admin\AppData\Local\Temp\cg3wmrcz\CSC1CACB087837416DBF4AB2640AB1E4E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4vnfivf4\4vnfivf4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF613.tmp" "c:\Users\Admin\AppData\Local\Temp\4vnfivf4\CSC98E6909E3E5C42FF958290E6F2A32CE2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c3lomad2\c3lomad2.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7F7.tmp" "c:\Users\Admin\AppData\Local\Temp\c3lomad2\CSC922973F19512481B983AD2A2E4179E5E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rlfni25r\rlfni25r.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9EB.tmp" "c:\Users\Admin\AppData\Local\Temp\rlfni25r\CSC612C5BEAAFB74CDE9FE03775E7C971CD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qhsq1cpd\qhsq1cpd.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBFF.tmp" "c:\Users\Admin\AppData\Local\Temp\qhsq1cpd\CSC41D0E214373F4AE287B2F113D289B20.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rs3mjj2v\rs3mjj2v.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE60.tmp" "c:\Users\Admin\AppData\Local\Temp\rs3mjj2v\CSCADF84637F3604FD3ACA63D7F83E7AB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xglmbar0\xglmbar0.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44.tmp" "c:\Users\Admin\AppData\Local\Temp\xglmbar0\CSC10B6AA0FB50C447A8877BC3BCE547F58.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qhmwispn\qhmwispn.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES238.tmp" "c:\Users\Admin\AppData\Local\Temp\qhmwispn\CSCF762F58B23754C5FA6EADB661EE70E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\he5etiid\he5etiid.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41D.tmp" "c:\Users\Admin\AppData\Local\Temp\he5etiid\CSC5B0F3E0671214109A0453864211BE99.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\epy0wkxz\epy0wkxz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES68E.tmp" "c:\Users\Admin\AppData\Local\Temp\epy0wkxz\CSCF44F10A9B8C74AA48044F7D5E7A0F5BB.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ydvech5t\ydvech5t.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES872.tmp" "c:\Users\Admin\AppData\Local\Temp\ydvech5t\CSCEA0307AD6B5F439593A6F1F436B74B7C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\worygwsk\worygwsk.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA37.tmp" "c:\Users\Admin\AppData\Local\Temp\worygwsk\CSCDE782D56D3484E75BD2A59FF82C24175.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qdwteta3\qdwteta3.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC3B.tmp" "c:\Users\Admin\AppData\Local\Temp\qdwteta3\CSC28307E55E0D4E17A5504E354D44F15.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wfv035wd\wfv035wd.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3F.tmp" "c:\Users\Admin\AppData\Local\Temp\wfv035wd\CSC54A164B1FCE6464497EFEEF3F1C0DA71.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\epbjwvfh\epbjwvfh.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1023.tmp" "c:\Users\Admin\AppData\Local\Temp\epbjwvfh\CSCE95E15C45C3F410BA71D1628035A0FA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0qmbwuep\0qmbwuep.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1236.tmp" "c:\Users\Admin\AppData\Local\Temp\0qmbwuep\CSC942A0A34DA8E4EB3940EE6677B9B0F3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qdejclfv\qdejclfv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1449.tmp" "c:\Users\Admin\AppData\Local\Temp\qdejclfv\CSCCAA326196C7A480787807825475792D.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dyfqkro5\dyfqkro5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES160F.tmp" "c:\Users\Admin\AppData\Local\Temp\dyfqkro5\CSC97B0FE375C194D6EBC3F5F4B442691C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cajmpd5d\cajmpd5d.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1803.tmp" "c:\Users\Admin\AppData\Local\Temp\cajmpd5d\CSC5B030289793345868198932BBBDF954.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0avscj1k\0avscj1k.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19F7.tmp" "c:\Users\Admin\AppData\Local\Temp\0avscj1k\CSC993C6D95DDAF4974AE54E69A1F0864B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\00dwglaf\00dwglaf.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BDB.tmp" "c:\Users\Admin\AppData\Local\Temp\00dwglaf\CSC998E73AA9F934A3E9926C7111BCD356B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qxvd505u\qxvd505u.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DDF.tmp" "c:\Users\Admin\AppData\Local\Temp\qxvd505u\CSC19EFF85D370E4B66A0FB1E464183386.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e12tklxf\e12tklxf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FD3.tmp" "c:\Users\Admin\AppData\Local\Temp\e12tklxf\CSC65561E3F73C3412DBF5C66E1AFF656B3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xcunmx5v\xcunmx5v.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21D6.tmp" "c:\Users\Admin\AppData\Local\Temp\xcunmx5v\CSC4F040B5DCE284678A48C867C9E739E43.TMP"

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4hoqtiym\4hoqtiym.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23F9.tmp" "c:\Users\Admin\AppData\Local\Temp\4hoqtiym\CSC44200E849835493CA82281F4BDED081.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\52at0cpb\52at0cpb.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25ED.tmp" "c:\Users\Admin\AppData\Local\Temp\52at0cpb\CSCF812C81868B2440F92CD1B9A92FA543F.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yhky3oll\yhky3oll.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27D1.tmp" "c:\Users\Admin\AppData\Local\Temp\yhky3oll\CSCBD40BD42CD78485BA0C592BD1AD69EA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0ylnnpgo\0ylnnpgo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29B6.tmp" "c:\Users\Admin\AppData\Local\Temp\0ylnnpgo\CSC99E8730BAE314BFF80B3A747A21599FF.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kjtizfrh\kjtizfrh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B7B.tmp" "c:\Users\Admin\AppData\Local\Temp\kjtizfrh\CSC76CD3C49AB444E25A55E553CB63779F7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dkhd1kih\dkhd1kih.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D6F.tmp" "c:\Users\Admin\AppData\Local\Temp\dkhd1kih\CSC8B3DEB4E8CD473783C2DE232B82A354.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\grygxzlf\grygxzlf.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F63.tmp" "c:\Users\Admin\AppData\Local\Temp\grygxzlf\CSCF2C6D80426D48B694D727F2B7892815.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hnfyltr3\hnfyltr3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3157.tmp" "c:\Users\Admin\AppData\Local\Temp\hnfyltr3\CSC3953166C133847D78D3151E646D3FB10.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g2m1jybs\g2m1jybs.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES333B.tmp" "c:\Users\Admin\AppData\Local\Temp\g2m1jybs\CSC2CE10BDA9D2B46A194F6EA674ABC340.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b45v5dnw\b45v5dnw.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES353F.tmp" "c:\Users\Admin\AppData\Local\Temp\b45v5dnw\CSC26682BC17D4FE1BCA1104520827FA0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y0z2e0bb\y0z2e0bb.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3781.tmp" "c:\Users\Admin\AppData\Local\Temp\y0z2e0bb\CSC789D2F68EF6E4172A91F3ABD36D53B5.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gkqud2sy\gkqud2sy.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A50.tmp" "c:\Users\Admin\AppData\Local\Temp\gkqud2sy\CSCCAF02DFF19A04D6DA9BF1C5DAA4D9CCD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\30zpxsr4\30zpxsr4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D7C.tmp" "c:\Users\Admin\AppData\Local\Temp\30zpxsr4\CSC30A8B41FDCEA4E249624AB7F4B9EC78B.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y3nmzf21\y3nmzf21.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4099.tmp" "c:\Users\Admin\AppData\Local\Temp\y3nmzf21\CSC10375AAED83D4392A31FC4F828906C92.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mgkjkydg\mgkjkydg.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4404.tmp" "c:\Users\Admin\AppData\Local\Temp\mgkjkydg\CSC5C79017CC79A4BF4A8959DCE65DA62F6.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ebdieki0\ebdieki0.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4694.tmp" "c:\Users\Admin\AppData\Local\Temp\ebdieki0\CSC1F1E346B16743F4B68F6869ACFDCAD0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f5yr5vzm\f5yr5vzm.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48D7.tmp" "c:\Users\Admin\AppData\Local\Temp\f5yr5vzm\CSCCCB392842DE44459A77FC2A1922CED.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\by11qusf\by11qusf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B96.tmp" "c:\Users\Admin\AppData\Local\Temp\by11qusf\CSC3034484F7545422C9ECBBC8867ED33A2.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vleldwgj\vleldwgj.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F10.tmp" "c:\Users\Admin\AppData\Local\Temp\vleldwgj\CSCB41CE13A64540DFA331BFD132D74E0.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ej32w5w\5ej32w5w.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51EF.tmp" "c:\Users\Admin\AppData\Local\Temp\5ej32w5w\CSCC263874D50344962AE0BA1861CEBB9.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hmg3dlby\hmg3dlby.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54EC.tmp" "c:\Users\Admin\AppData\Local\Temp\hmg3dlby\CSCB2D4C6F19D4544E88F787C193F1C7CD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ssqtbzd0\ssqtbzd0.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES574E.tmp" "c:\Users\Admin\AppData\Local\Temp\ssqtbzd0\CSC7EB572D7C8F0441ABB4E9D779FCC1A8.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g4lwxfm1\g4lwxfm1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A1C.tmp" "c:\Users\Admin\AppData\Local\Temp\g4lwxfm1\CSCA013598CA2CE494B8C32391113B2A1C.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cxi5lssb\cxi5lssb.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CCC.tmp" "c:\Users\Admin\AppData\Local\Temp\cxi5lssb\CSC789DBA70E8E246EFB2919E3928354FDA.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fe2u0i3p\fe2u0i3p.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F7B.tmp" "c:\Users\Admin\AppData\Local\Temp\fe2u0i3p\CSC3ABC19EF137F4F9E8FC08997B7977D9E.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\czosxesj\czosxesj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6269.tmp" "c:\Users\Admin\AppData\Local\Temp\czosxesj\CSC71BDE85BCDBD418491E4BD35961280AD.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\05qxcolz\05qxcolz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6519.tmp" "c:\Users\Admin\AppData\Local\Temp\05qxcolz\CSC567AC9686D1849F8863C4C2FE7941DE.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cf2p5xyo\cf2p5xyo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6855.tmp" "c:\Users\Admin\AppData\Local\Temp\cf2p5xyo\CSCF210212568FA4C6680B643509BED1B14.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mdvpxgmo\mdvpxgmo.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BC0.tmp" "c:\Users\Admin\AppData\Local\Temp\mdvpxgmo\CSC4986833136FF42BFBD7D96F32098F3.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pkfnbp0r\pkfnbp0r.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EAE.tmp" "c:\Users\Admin\AppData\Local\Temp\pkfnbp0r\CSC2A44B9D98E514FC1858EF1CC5B95F10.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ba025ch\4ba025ch.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71BB.tmp" "c:\Users\Admin\AppData\Local\Temp\4ba025ch\CSC52CF618CBA714E069D96762E0EA6CF7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ewzhzkzf\ewzhzkzf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74C9.tmp" "c:\Users\Admin\AppData\Local\Temp\ewzhzkzf\CSCB1B03302C7694D5481F325E2F2EF8AB7.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\58174d87903175d3435b0797c5cbca72_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aaghpd14\aaghpd14.cmdline"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 meeti.hopto.org udp
PL 185.244.30.251:1122 tcp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 233.143.123.92.in-addr.arpa udp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 meeti.hopto.org udp
US 8.8.8.8:53 meeti.hopto.org udp
PL 185.244.30.251:1122 tcp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/968-0-0x000000007492E000-0x000000007492F000-memory.dmp

memory/968-1-0x0000000000D10000-0x0000000000E96000-memory.dmp

memory/968-7-0x0000000074920000-0x00000000750D0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rqhy0ptp\rqhy0ptp.cmdline

MD5 50dea0abf22ba32cb612dd3d1b542100
SHA1 18276b7938acc2b1927be25b87a4cb64fb867afd
SHA256 2c4749939816a5a46ec44419f8956a2fed79e30dd7fcb4eee8010910666873c1
SHA512 6a81e0e6ab6db91fa7ad6707c6862e420224107bf4944f833dc9c2cb466214eeebab733b81288c3b11affaeffc9d69b020ff7ec5ecc35eb2a5d46227963b5b0f

\??\c:\Users\Admin\AppData\Local\Temp\rqhy0ptp\rqhy0ptp.0.cs

MD5 3add63d70f7cf265c31ad4493b45a28d
SHA1 b125041f6d712116143020fe3b4c0deaab678143
SHA256 f20c56aaf9f9f21eb0e5cd84d863176f442d8bb0a59ec2ae4f91c928a4754bda
SHA512 e4614a662da9db59e126885ea8e7c42e605438e3a09dd7a71b4a5ea8a0182bf8a2a4f6c0fefa5761bb24527940cddb6644a1e27537afac9231fcddbc297b4a9d

\??\c:\Users\Admin\AppData\Local\Temp\rqhy0ptp\CSCF98CCD98972243AF9FB622D9C719E4FA.TMP

MD5 2eb11510fbc4ebefe348724342d21e22
SHA1 93eafa2f05daf18bcdae3d396e46f4a17ab3dc94
SHA256 fa4ad2e42e12bf5d96d3c4806390b9f55ab3d204257ae195d86392569986259f
SHA512 597f11f8c9efcc527f8526cf46713844ec8da54b135f2b466059e574674b15b1974fffaf562bfe4242e62d98413b086f5b46d8b1f982a36fdcb3f9e0c4c28ae9

C:\Users\Admin\AppData\Local\Temp\RES3A0B.tmp

MD5 fdcf61abd6850b6bd5053975bab0c316
SHA1 820159054e82cbf712750d19af812497fafee942
SHA256 20591d8aa3b9d1bef1de910c05467e8b860800c6c14ebfbb1b25927dd7ee1e0b
SHA512 ca822e586080b575e3b9760a3f54c302b76c864617e02e54502d866abbf234a7719ce86552a62933c78a73976a7052f40970f743fc0488d46e032fa7c314aa10

C:\Users\Admin\AppData\Local\Temp\rqhy0ptp\rqhy0ptp.dll

MD5 a955f8f9ad6a8c09126585bc0612268b
SHA1 0488be7018bc3aa2c533f990d7f950835832c34c
SHA256 20f299f3fee50a8946e053519092a8006a153676eeaf6ed75cf3f559b89178bc
SHA512 dd13d6d62e6c8dd2030f1a341d80b4cedd35945f05f43e376fbcafb521be99835b0c5fc10c7726dd88a7c935b2e6232f97d833020e9b7175a58b494d2144ef66

memory/968-17-0x0000000005780000-0x00000000058E0000-memory.dmp

memory/968-19-0x00000000058E0000-0x0000000005968000-memory.dmp

memory/2212-20-0x0000000000400000-0x000000000047E000-memory.dmp

memory/968-21-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/2212-22-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/2212-23-0x00000000055B0000-0x0000000005B54000-memory.dmp

memory/2212-24-0x0000000005000000-0x0000000005092000-memory.dmp

memory/2212-25-0x0000000005140000-0x00000000051DC000-memory.dmp

C:\Users\Admin\DocumentsWebSocketCloseStatus.txt

MD5 d510225b94b0ebe2d5414699b2a89771
SHA1 3e79f1ea8c96ed35a27247227c533c5c4dd6010a
SHA256 01d57933cac2d50b0b439e322323f20b0083302f1ae80263ff151f3390f4be24
SHA512 dc28498c4b43efcbe4969e65cf6f509a352fb2221905a1eeb43b955bab2ed55852e8167d13f9dc83b736c8b0ddd6b270d8d7c120720fb6406279c17aaa43e399

memory/2212-26-0x00000000050A0000-0x00000000050AA000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\hln53l0j\hln53l0j.cmdline

MD5 dacebc44df20c228f8212e769b003c27
SHA1 d9892c5dbe73a04feea7293ecc680f7a0f2b19b3
SHA256 e542f533d6ef262305e86e9aacb84163b957c7d02a209bb07cf17d6fb0bde591
SHA512 ade8732b976eaa65bebc8dd05e1bc2d7c5d1fcb788da78b4e7ea969814177fc6976434e17e387d23f616401fd71b9145a0c5f4ca00056bcf0e9cb12226763b9e

memory/2212-40-0x0000000005130000-0x000000000513A000-memory.dmp

memory/2212-42-0x00000000052D0000-0x00000000052E2000-memory.dmp

memory/2212-43-0x0000000005EA0000-0x0000000005EBA000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\hln53l0j\CSC6C51C2501E00461CA528EAA1B5C04354.TMP

MD5 229d0f8e055c4ca6bd7bf2252e2ee0ce
SHA1 7fa4cf763d4af118d871092f191ad63e19646efa
SHA256 b4426812e371a8984c3e376b047e4fdc8b3d9c8015eb8c6d3bc11909c2a4321a
SHA512 fd3b56631e1aba9caf9f7b363c5a8ade045e7379c1d11c119a412795ff985789f86b0ebe0cc516870e81ecc5337d29b86cadff274e6bcaa8e8ee49fe451f30dc

memory/2212-50-0x0000000006040000-0x000000000604A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES3DF3.tmp

MD5 e052f7d63f280437f4de9159da1ede1b
SHA1 5b2927b1996df148a7a74c94e8e718b5ceb13f0c
SHA256 aa53546b3672ae9ec4904e431f2dd01bf5df629183a611c60058c597ce04e0f4
SHA512 53c84f4e61eadab2bba4c987ed3719c09e26c93bfa4b0f2f916ad092de9ba7ae52b7ba2bb37f73486bf89485e382c5c836b873fd5301bdab6a668db5c1533806

memory/2212-51-0x0000000006190000-0x00000000061BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hln53l0j\hln53l0j.dll

MD5 1858b75f4f1c52e0d177b923dc21d891
SHA1 928206c9652abfb9598d9717064080077459f831
SHA256 d01d815406dafb78f007134de5b05623829302e1afb85ca23603b98efd00da6e
SHA512 f65f4c413e1559bd4008fda0f05e5c95808444cdccc31765b605f9edf6b3b9b635ae92c87ebe810b54dcfd1c97921242727b251e0bc1addf8b42616dd67e42ee

memory/2212-52-0x00000000061C0000-0x00000000061D4000-memory.dmp

memory/3956-54-0x0000000005170000-0x00000000052D0000-memory.dmp

memory/2212-47-0x0000000006010000-0x000000000602E000-memory.dmp

memory/2212-46-0x0000000006000000-0x000000000600E000-memory.dmp

memory/2212-45-0x0000000005FF0000-0x0000000006004000-memory.dmp

memory/2212-44-0x0000000005FE0000-0x0000000005FEE000-memory.dmp

memory/968-57-0x0000000074920000-0x00000000750D0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\xld1rxff\xld1rxff.cmdline

MD5 9d27b21603ee997dad9809c603a1ca53
SHA1 875891b4bf37d746372299ffb4ea1d1c6debd854
SHA256 ee2d5b7b08c0931554e23f7afd14b2e360befbdb2e800421036cb370997b5647
SHA512 d121163ee8f7f3d12c476b7ec91f19ae7bb4a05dbb7858d94ccf33db42222d5f7dff66f6d94671c5a05a93eb5132d8572017f26a27fa8d34ea03c0f1654a04fa

\??\c:\Users\Admin\AppData\Local\Temp\xld1rxff\CSCB993B09E25494F8891E48CF44B92E46.TMP

MD5 9f47d96d169788e362d0005d5288e94c
SHA1 b6cf30ff5f99f9168feb7e23d75a8e2f9e9b7905
SHA256 1b81cf0b553ad0245e2512a81cc3dce8295daa868f35be7618a7a683c5fe72ac
SHA512 e9bd1a6ff49f20753c393fd14621f8e25055085997a9d80fa2ed18b0e9b420fc01830a1fb874463e7d718069edd6de95ebe003d9c04bdd7d2cc69441063025ae

C:\Users\Admin\AppData\Local\Temp\RES4277.tmp

MD5 2cf3162d17f2ecc789daf44481398e0d
SHA1 76150d9069117a50b93518314031721f19d8cff3
SHA256 8cbb0537e17df3363f32c5ed22f2a1a63e37329fdbde4648b1fa3880e670c46a
SHA512 0b64c948eada9375b419b4f9b03c1290ce7ae88fb2562450d4733b2559285206dd5e57d49059152c48c4583ac4fbf1c6e3529e45c8ee1f073552577b9904f961

C:\Users\Admin\AppData\Local\Temp\xld1rxff\xld1rxff.dll

MD5 0c149ab8526819cd022e90cde0754c16
SHA1 1b15d571c16341bf45c95ac799c43f8967f542b8
SHA256 d6aafdc6bf3b7a21e8190b4f34c6f5d40c4ed253aa01d0bbb5e028c64777803e
SHA512 dba175653092fa62f65c143e5af338045763b171560e20613b029fe80d982cd93924cd14611aa34884cae2b36a5a2bc90b0d54ccb15b187570fc0ccfc672992c

memory/3316-73-0x00000000058C0000-0x0000000005A20000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ws32qa0x\ws32qa0x.cmdline

MD5 13ad3fc7e56ae7f342e22559ce91553d
SHA1 9b324c2efe3b4f8d3a6df81c6d79ae0d72b7bb1b
SHA256 15ca691104f69e86290bc86aa1a381d63ebf1ff72b10ecd9b00c517401eb0b3a
SHA512 cadcabb67a3b2b0f29a25a3d60c52a38e05e4336ad237fc9528aebd5075c33f84c70dd3a71885e5beb8b98c60f2a0275254d5ffed178b0d624d05abe2cb012aa

\??\c:\Users\Admin\AppData\Local\Temp\ws32qa0x\CSC30474657ECE64B4D9DFB174DE96FEF3.TMP

MD5 5841a72c69617e3f054de77413321fbf
SHA1 b03dcff056c5f3b92b8bf5cabfb09ff10ce77dfd
SHA256 c81f0432a38604b9c6e43cd4f91aaffe6c34874a5bfd7c78decd5c1e1a3592ce
SHA512 5f8cce01c441a2a7a94b2bb622f6df62262b2db5fe51c7cc24b7fa48cf7aea99b99d2a845f2799c7b085834ac147eea83ab78efdba49ac0d322efc523e1a2483

C:\Users\Admin\AppData\Local\Temp\RES44D9.tmp

MD5 78f74f06c1d50c8f279b67e7ec5dc527
SHA1 c2b696801f8d15e17c8f5fa35190d54dc05838bb
SHA256 f969e906578a149626fb8a6448c5355e439a490cc574798c9d6a8935cb32c841
SHA512 156222e9ac5af650c52223142a26c8fee3f031d699da04ec9ba7a92bb2a15025c3316a0f02cf392173c72027ccb5737577d800145a5c437feb6a37c17f7b802b

memory/2584-91-0x0000000004AE0000-0x0000000004C40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ws32qa0x\ws32qa0x.dll

MD5 85cd6184bb52bb6c926b070b548b076b
SHA1 41cba0b27309372d7691bcb451aa37c77fd6c1f6
SHA256 231ccfda29270cac664bdd991c9ac70eef0c820e2ff09c68c3d8f56d30b4b2ca
SHA512 303c1e361ebc063a532d61de278200e7eff145343f2811ed6d36267a5c050eb355ef6b39601ebe3449b6342552de76a65fe574653013ee333e7c64582fa27a18

\??\c:\Users\Admin\AppData\Local\Temp\nt4rfssw\nt4rfssw.cmdline

MD5 a8c665722fba34ff7d25cd12c293ed0e
SHA1 81ed9f43693611024d10f7ae2ca4d278a8025516
SHA256 926a06724817fe6ba73c223a3fa22805713c2bbe92e8f648f9aeee452142bfbe
SHA512 824e5d6fd07b1f5e7d03e02288000694426616a279e1dfcb34410886dd8d941b56a3b210e5803ebff556e2cb879ff307fa0114ed60af2f9dc5fc19e72e4a39df

\??\c:\Users\Admin\AppData\Local\Temp\nt4rfssw\CSCD4450F33C315410A988C6DC38993C53A.TMP

MD5 b666562562d94f851f250fedf78d534d
SHA1 7245c0fde44afe677f46846d1669a41695d57e85
SHA256 ef8a6b691df221870b0c2be743ca5fb3684652714798f877e8a58988c35a779e
SHA512 2617f5b43f436c3a3b652ce5843a1ee02f361925247a45e9c449ed68696a75109cfd0d8e7b2bec77ebb3eaef3eddeec08b5595a689262bf188b0b3b586dbe5d0

C:\Users\Admin\AppData\Local\Temp\RES47A8.tmp

MD5 91b92098fb10f7ee1555d3f0bf1ac558
SHA1 d4880588ead8343f7eddbed088887770b02f1dff
SHA256 bfdac8d188b7a48b2622e4322477521a578f907e5e853c12fb46c5ec41670c38
SHA512 5ffc29100aeec3128d9aef20d686ca872506b6e807a91592a789f7921fc854b057bad9e12dd670c67a69e593c551380dccd4069e344cb9025b3b29f8566b9dbb

C:\Users\Admin\AppData\Local\Temp\nt4rfssw\nt4rfssw.dll

MD5 a4d09f4fd433d22b84937b887a58cbaa
SHA1 d5f3f03cebdc286fa6d9584812ac2f659022df6a
SHA256 afcb0908fcccde463a4116b239784bce2fa0b625869189750d974a92e6c9e02a
SHA512 429c664afd35ed60bdee2484d83e3b214bef17063919de7e2bb8d0c382f730ba2420584adbcdf05fbbc9014c3455d7066ee9182182a66a872a06b73bbc5420c9

memory/3952-109-0x00000000053A0000-0x0000000005500000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\whvnyzja\whvnyzja.cmdline

MD5 fbde868f83ac79d4c4259dab4235d53e
SHA1 febdd4a5ed480137c2ab6c124b4e9be923c30b4d
SHA256 e2a8e9d08a107a8c82400fcaa53192523eb7d34400d8d76ec2dc3e571abee0f0
SHA512 e2e97b13d1f1211e0b0b79243fa65e4cb00501816ad6cff42ad96216524e822adec78bce78eceb0beaa1925b95b72912a0cb9384d7d92ca286c2ebccd6761631

\??\c:\Users\Admin\AppData\Local\Temp\whvnyzja\CSC2D7704EF9BE7489595AC4EC0467A9D25.TMP

MD5 5f5ed89a409c92945950b1b376ea1afb
SHA1 a47b39795db3a2eeb563f32c4c93b4b2b6e6cc19
SHA256 09717f3ee7055bb07f1a241760fced122bfd6523f4cbba1a7ab832a2f36a18cc
SHA512 437c3ae8b5a27866e9ec4e6f0587108bf9ff4f32a53f170b83555759bb8ae25338650be523a2f10df1bbcfa668213f7eaa85d7ab9d938af63c002b48bc49fc66

C:\Users\Admin\AppData\Local\Temp\RES49CA.tmp

MD5 6c296d64798440e3eb0391793d3d431b
SHA1 4e152d892f32983afe8bfe10d83300584f94f009
SHA256 ea804f69bbef29c58d72c601fb9a6710ab185cd8b6dee7d1ccaab6bf07f05eec
SHA512 a53d193330e8a0e767d3ba7efdfdf70e55c1c6b4bb2325368b072e45f4bc093a76e502d10e8d1b25c5d01c40c962ff1ea301d74f8be33c1d52d37fc1867def4b

C:\Users\Admin\AppData\Local\Temp\whvnyzja\whvnyzja.dll

MD5 119c20a7b2e88ba8c784c2aa82dfd722
SHA1 fb7882d70e9665e49d391dba5841f6294775a0c4
SHA256 64c8a6bbd29dfa5206520b6c2774cb4be36e051bb2934a3dd16d774df84a4c39
SHA512 1cb5d8283d369d5c8c7bd4b0603e0378777adda80ad66f956a0081ad8551c904aee6062a6d7df8fabeb20c1e4fc471b35888ae212e1cf2aa577d990aa17be7e0

memory/1476-127-0x0000000005240000-0x00000000053A0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ig0wdkp4\ig0wdkp4.cmdline

MD5 2acd50f787d1044d9b35cecc54038e12
SHA1 d787a456d26ca4a673ef65ef3049a7da08546cfe
SHA256 94867456ef40ed72911d91f29c51c7a3e31958e1d3d8554a6e49cb6d4da26a20
SHA512 7aea18f2ed0fd76303db396c77f4eb22c95ec4e63b15ace4c485a108ef99fe5fcf86dbfabb8d248a375c7b5274b0329ad7ec55b1db2b1134089d475e43bfe677

C:\Users\Admin\AppData\Local\Temp\RES4C3B.tmp

MD5 ed49f5f0da25d66505b245b631109ff2
SHA1 23580f92de9b8cf6b8eeb14987125ae59f474fd6
SHA256 e89b43bb9ff1f4b526f392501dcd3cdae2144d6abee698f7e452e9e15a6f425c
SHA512 fb64e9ac93e687c128f78cbac5c015bde927350e3823552f4aef9e693487b470412b4c0520eff1565d42fcc99d4b927db1e3efb3e7c077c9c1d5a15cb3b348ac

\??\c:\Users\Admin\AppData\Local\Temp\ig0wdkp4\CSC35B08EC31C1E4701AB73FF67CE43CBBD.TMP

MD5 8bc5ccbaaa222460bb91fe2dfcf22d6d
SHA1 52aaf8945185c7e0cf1e2ba5a67746730f127aa7
SHA256 589e0df878a87e51e5543c9e1f51dc8a81c359260683989ad4666da8afb1de60
SHA512 9d5e121c49e6c1db9067c53d7be4590e0ee77fe75b4001f43ff46f9bc77c431dac202f07e4de7a8ac77e2895c7089fdc074b183f30a0b8d311459f0df9662b8a

C:\Users\Admin\AppData\Local\Temp\ig0wdkp4\ig0wdkp4.dll

MD5 9f9175f9bd49fd716a3a0a2a4b2429b4
SHA1 1b8bcc93ee96ea3212ab72189d46c1ff0b07e3a8
SHA256 2048103b8d634f234d03138941c09f0a0e32f22d049af9737df7b92e5bb741ed
SHA512 bcd50d45fd8129d7ae934a78689667af7f5c2a0e5f18d1630c89781b9c87a4c2d6953817ccfb65aacd32f967991b319b04e2b2ddc1ac216d834202429c428561

memory/3512-145-0x0000000005A10000-0x0000000005B70000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rfiukjab\rfiukjab.cmdline

MD5 84e16698e7cea8b6b5b7bbc8096bedcc
SHA1 f9de14fc4dba41acd13364852eec820a20de1d49
SHA256 06fc8861b42d8e6823ee4a2db5078aa98dcb952c7d110ab043edf31ff86b92d0
SHA512 3362f80496a2f8d3cb6595c38d5e429016003d4aef0a9454f04fd16d6ea374aed2db520344c04a51e792077f939dc58fa5df07186e2d995fe2905e9ef8fba615

\??\c:\Users\Admin\AppData\Local\Temp\rfiukjab\CSCE776E22483D142AFAA988A69CDE85FD9.TMP

MD5 5bf05d8323e068e6eea601bacc8b8c25
SHA1 31d88721d9dbcf165d020736e875591e173a254a
SHA256 6bc407104997f645a25a0e810ed8bff41e7f984726b20bd70c71d986003abf7a
SHA512 0b3e4802c73eaf305bdf24da025d2e7003c141b0bc738cbb2c443b0b6fb63e189f48beba85b831f6ffcbfaee87223409cc7defbe0b12016da8c6f2c1c5b152dd

C:\Users\Admin\AppData\Local\Temp\RES4E6E.tmp

MD5 412b81c6b326d52f4ae8102fc057eeac
SHA1 6775a565c993732d48121f814e38a950e83b36e0
SHA256 a0b144ec930dcfffd68f60fbc8f9f196975271a988b3cd315df8bdffc4ab517e
SHA512 9eabac8df9c41d811e4cdc442c26842fee0b0e5e19205c95dcbc1e7cffb96e53a2ae7efa503fc2ed312e072dcdcc3e15bc7142dfe7d609fc8570f37828da7011

C:\Users\Admin\AppData\Local\Temp\rfiukjab\rfiukjab.dll

MD5 fc9edcda6c193df01d425f4b3aeb3eb8
SHA1 70f1f959f4de8d5d970e7163b3f308395df62b1a
SHA256 3822d97f59d6b6b25c5aa028a727c36c199e6b2b322a62c2f2ffeded8d31195c
SHA512 ca0da0a6f0613882e0ca72499998e49e92bb7fbfa5f8aa0dedfbc28353215a19e59363ba7dd7314179681e2938ccd02602a4e2e8bc88ebf27678bbdcbf036e73

memory/1876-163-0x00000000052F0000-0x0000000005450000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\mi2j5pgt\mi2j5pgt.cmdline

MD5 2365b113030674ddc93fa3e78661f27b
SHA1 08c2606e7764315dfe46fc2efd3f010f9fea5e27
SHA256 454cfea5dda42eddb829ba90f1d471a172983f869d1a7456295d45c4bf984667
SHA512 9dc6cca94f7040f9f2ac28bdf806d7a9659d84671de6ff09db4aad0683480f11ff6c0dfc79314e577536ef44daf43c8f66f46eb3a62f92e80eca3e29c81aa899

\??\c:\Users\Admin\AppData\Local\Temp\mi2j5pgt\CSCDA2B4E043DEB4A8AA13AB99E9AC2CC9A.TMP

MD5 2227280ad274f71cbb8ef890e0092dda
SHA1 8681eea8552f7d64e31d495d3bbfd11165fee0ae
SHA256 1825934eff841b07512d0b54586732f2a64b1b827908d4f6bf24a4fda63bfc93
SHA512 03e836a114189bfd4451596ff5cf809eeb59257ed0de3ce6fb06e1d0cebeb637a01bf2f8ab102858b9adf3309b8923dca4b097c398b1d23b13e9131c673d807b

C:\Users\Admin\AppData\Local\Temp\RES50DF.tmp

MD5 8c60e0613c00cb350d15e1642c2ad312
SHA1 31fef68094202577c76e1f5f2b2189d7a23b083e
SHA256 c69ecd666c289ef4c2941f6c66d3d866560928bb37649039f72dd3676c9a7a0b
SHA512 8ac6e5e0bb8d94911a2a766313ca847954c5f971807c8a31f625c275c7fc4eed30a0df918cb2f865ee71475526b577eba9156c29c3bbe98906448f626cca9bd2

C:\Users\Admin\AppData\Local\Temp\mi2j5pgt\mi2j5pgt.dll

MD5 ec79d087a352fb2177e17d27f78dcdd1
SHA1 b1af83c49a4c590aea79c4371ae8b0d3c6f0bd24
SHA256 c2f011f5c2f5846da8f7df7c86794e43d14e32401039e0a508ebf3cdf0207e49
SHA512 6e0f0b48273e987c50ddee080db894f213afbc4bb0a01e9810fa7d3ee65660bce7b3d6797db3f4e692ae357c00f77f2849da0fc36ad3ad148a79304e9d4dbb83

memory/2216-181-0x0000000005650000-0x00000000057B0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ydtzvd5f\ydtzvd5f.cmdline

MD5 677abc9b64faf45ec83792525aea0ce8
SHA1 cbd64845d02b8761b79e199d6748f4f65b867ccd
SHA256 a7890489489d9afecb7d64bec3bc78a506c48a6be0718e1ba03425091257e66f
SHA512 d78882c7955fb865aa86be50892a0f92722d259f9cccdde9d996ebd19dce8863431c062c8fd514c27c21e29926ba7cb743e0affbd2d0e7fd36667e2f062875b6

\??\c:\Users\Admin\AppData\Local\Temp\ydtzvd5f\CSCA3B95EC1414342CF93D333E86E667E32.TMP

MD5 b9ab27d4741eab00694204640ff9b219
SHA1 bdf9482869af6d64fca9f26363897c1425642b7d
SHA256 4f9a238e7c15591476ff28ed3f34442a14e33cda15bf9f44da1c27abf2f16674
SHA512 fab5916119b789d4c8e44af4bfd1a85de5e2c2029a03e283c3cfff6be658e9cf7558d4603c0e50728fef66bc01874845a4749722109e593b9060fb0cc7191e92

C:\Users\Admin\AppData\Local\Temp\RES539E.tmp

MD5 1dcebc000af692ad8b4a38c034c9304f
SHA1 588cf967a0b128726655015b62d5e35531f1213d
SHA256 2daf1e42904f570753031140d85ce73adebc4cd75e949513d14abbc49a6096e2
SHA512 b6536e9a4a5b6fb7a16b62ea65217e2e382e0aabe91a948b1adcc365b033184e438a293c38ace39c297791cc704b052192f549f19b8b493e8377d458bd7e1cac

C:\Users\Admin\AppData\Local\Temp\ydtzvd5f\ydtzvd5f.dll

MD5 642262f3926f52e0523ff197c79325e3
SHA1 44e5bbb546dc2b2b004b6a902795dcd1db149896
SHA256 97b2ffb8e348ed06de619e3c2dd586f98f841a2616e3a3c4eee0879fe1f75322
SHA512 c05187eb211f92fb997aeea6b0fe6f5aab24430bfe423fe3297c03898afe0431df7d8eeb1b87d6413ab1fd440b74d4678878ba44b8600fbdce695f938bb2dbd7

memory/5092-199-0x00000000051B0000-0x0000000005310000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ikalb1mi\ikalb1mi.cmdline

MD5 3ba2ac1dce70a7f8822ded382b6d4397
SHA1 c2836adcd41c10707fd2bf1e913471ea292d38d0
SHA256 9f318c351ebe8f08ddede936ec40a0316edc6da1bc91a801e7725f858dcbaa36
SHA512 66a3632dc54dfe5b8c7c0d02e16df432ad583ab5d77645fb47120815cd8062f02ca4d8f5668efbb0b2017ab540340995971152494e1f853bb00546c66f5dd9d3

\??\c:\Users\Admin\AppData\Local\Temp\ikalb1mi\CSCAE7B279BBBB04FEB9B9ACEAD2DE5E5D2.TMP

MD5 0a2570b75c48777dc5e8968a90098a56
SHA1 7effff32b77324feb3c5d498644feef4d0fe5305
SHA256 57afd97cc33697d40b127010493ebea1197798450f181aa5c1dbc825af02cd25
SHA512 a5fd90bd04ff2a0a63fba0850f8b337a4e0949db14b6941f330ad165c821b95df96e6210ab949148938aeb939d0c5f981d9b125e3e7c80c6d05e8d311d2e5b79

C:\Users\Admin\AppData\Local\Temp\RES562E.tmp

MD5 23dbbafcf7f27cc17e1fcd8a921a1498
SHA1 b51cea3f16ef66bcd6090bfcaecb10e25069c0f7
SHA256 7fbae829b4a6495ac17680a2ed66cfa8b9dbe47504cdb89db0a4d722a64d4cc1
SHA512 9c15afcedf3ac248feece860f2b1e295246663cc322f271052b214a1ed2c0404014f1dc555ad64619ace751d4c1da09bd0bc2fd4477634d4b9e780d356a0c1f8

memory/2232-216-0x0000000005A40000-0x0000000005BA0000-memory.dmp

memory/3272-229-0x0000000005620000-0x0000000005780000-memory.dmp

memory/2268-241-0x00000000052D0000-0x0000000005430000-memory.dmp

memory/4468-253-0x0000000004CC0000-0x0000000004E20000-memory.dmp

memory/3092-265-0x00000000058B0000-0x0000000005A10000-memory.dmp

memory/3000-277-0x0000000005610000-0x0000000005770000-memory.dmp

memory/3612-289-0x0000000004D90000-0x0000000004EF0000-memory.dmp

memory/628-301-0x0000000004D70000-0x0000000004ED0000-memory.dmp

memory/4816-313-0x0000000004C70000-0x0000000004DD0000-memory.dmp

memory/4292-325-0x00000000057A0000-0x0000000005900000-memory.dmp

memory/4476-337-0x0000000004C20000-0x0000000004D80000-memory.dmp

memory/1536-349-0x0000000004C10000-0x0000000004D70000-memory.dmp

memory/3572-361-0x00000000054A0000-0x0000000005600000-memory.dmp

memory/880-373-0x00000000053A0000-0x0000000005500000-memory.dmp

memory/2240-385-0x0000000005290000-0x00000000053F0000-memory.dmp

memory/2776-397-0x0000000004F60000-0x00000000050C0000-memory.dmp

memory/1920-409-0x0000000005860000-0x00000000059C0000-memory.dmp

memory/1476-421-0x0000000005130000-0x0000000005290000-memory.dmp

memory/2948-433-0x0000000005230000-0x0000000005390000-memory.dmp

memory/4816-445-0x00000000056D0000-0x0000000005830000-memory.dmp

memory/1572-457-0x00000000056E0000-0x0000000005840000-memory.dmp

memory/1412-469-0x0000000004C00000-0x0000000004D60000-memory.dmp

memory/3768-481-0x0000000005450000-0x00000000055B0000-memory.dmp

memory/4180-493-0x0000000005220000-0x0000000005380000-memory.dmp

memory/2392-505-0x0000000005400000-0x0000000005560000-memory.dmp

memory/4408-517-0x0000000005990000-0x0000000005AF0000-memory.dmp

memory/3164-529-0x0000000004D40000-0x0000000004EA0000-memory.dmp

memory/4564-541-0x00000000050C0000-0x0000000005220000-memory.dmp

memory/4940-553-0x0000000005BC0000-0x0000000005D20000-memory.dmp

memory/4576-565-0x0000000004FE0000-0x0000000005140000-memory.dmp

memory/3208-577-0x0000000005A60000-0x0000000005BC0000-memory.dmp

memory/4132-589-0x0000000005050000-0x00000000051B0000-memory.dmp

memory/4480-601-0x0000000004D30000-0x0000000004E90000-memory.dmp

memory/3164-613-0x0000000004EF0000-0x0000000005050000-memory.dmp

memory/1388-625-0x00000000050F0000-0x0000000005250000-memory.dmp

memory/2212-627-0x0000000074920000-0x00000000750D0000-memory.dmp

memory/1668-638-0x0000000004CB0000-0x0000000004E10000-memory.dmp

memory/916-650-0x00000000054A0000-0x0000000005600000-memory.dmp

memory/348-662-0x0000000005880000-0x00000000059E0000-memory.dmp

memory/2120-674-0x0000000005B50000-0x0000000005CB0000-memory.dmp

memory/4860-686-0x0000000005660000-0x00000000057C0000-memory.dmp

memory/3216-698-0x0000000004AD0000-0x0000000004C30000-memory.dmp

memory/4956-710-0x00000000056F0000-0x0000000005850000-memory.dmp

memory/4528-722-0x00000000050F0000-0x0000000005250000-memory.dmp

memory/4212-734-0x0000000004E40000-0x0000000004FA0000-memory.dmp

memory/4380-746-0x00000000051A0000-0x0000000005300000-memory.dmp

memory/2120-758-0x00000000056D0000-0x0000000005830000-memory.dmp

memory/1744-770-0x0000000005610000-0x0000000005770000-memory.dmp

memory/1948-782-0x0000000005710000-0x0000000005870000-memory.dmp

memory/2232-794-0x00000000050E0000-0x0000000005240000-memory.dmp

memory/3268-806-0x00000000056D0000-0x0000000005830000-memory.dmp

memory/4080-818-0x0000000005620000-0x0000000005780000-memory.dmp

memory/4596-830-0x0000000004DE0000-0x0000000004F40000-memory.dmp

memory/4816-842-0x00000000055B0000-0x0000000005710000-memory.dmp

memory/4604-854-0x0000000004C70000-0x0000000004DD0000-memory.dmp

memory/3100-866-0x0000000005170000-0x00000000052D0000-memory.dmp

memory/4732-878-0x00000000057C0000-0x0000000005920000-memory.dmp

memory/4044-890-0x0000000005020000-0x0000000005180000-memory.dmp

memory/2248-902-0x0000000004DD0000-0x0000000004F30000-memory.dmp

memory/4580-914-0x0000000004BB0000-0x0000000004D10000-memory.dmp

memory/4600-926-0x0000000005210000-0x0000000005370000-memory.dmp

memory/1972-938-0x0000000005B20000-0x0000000005C80000-memory.dmp

memory/452-950-0x0000000005620000-0x0000000005780000-memory.dmp

memory/1380-962-0x0000000005870000-0x00000000059D0000-memory.dmp

memory/3836-974-0x0000000005220000-0x0000000005380000-memory.dmp