nanocore | a88b51910b9ddaf017d1e1ab39eafdadc3c095aa17ce17dd239e38bdddf0235d

General

Target

58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Size

1.5MB
MD5

58a37ded7d1b1f73f58bd17008e0876f
SHA1

a3133b2843899c77f9264689f2a771d3e07f19bd
SHA256

a88b51910b9ddaf017d1e1ab39eafdadc3c095aa17ce17dd239e38bdddf0235d
SHA512

a8e1d586d4589843a00dd8fd9817054054b82030fb7f5db8a38ba1f1dafd01a70705a30b39497f928e26554b439730483d80a21f3035f68a8cc41be7fd3f2309
SSDEEP

12288:g/Aka4d2u1dgjYnYOpbWakQclTVKcXrqI63uL7UpzFxAbz4sS8h8ICxbLqMTDDBW:0AkhHoKtkP4amyezFwS8obRrq

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

meeti.ddns.net:83

meeti.duckdns.org:83

Mutex

ae4b70b9-d113-47e0-8b7b-8282a51d736e

Attributes

activate_away_mode
true
backup_connection_host
meeti.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-07-26T23:46:56.996308236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
83
default_group
A New Eraa
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
ae4b70b9-d113-47e0-8b7b-8282a51d736e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
meeti.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	RegAsm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegAsm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegAsm.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

description	pid	process	target process
PID 840 set thread context of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 set thread context of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 set thread context of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2024 set thread context of 344	2024	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2680 set thread context of 2708	2680	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2320 set thread context of 764	2320	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1020 set thread context of 2308	1020	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1672 set thread context of 2296	1672	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 628 set thread context of 1268	628	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2036 set thread context of 2264	2036	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2212 set thread context of 488	2212	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1480 set thread context of 308	1480	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1876 set thread context of 3064	1876	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2208 set thread context of 1980	2208	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2168 set thread context of 2804	2168	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2780 set thread context of 2872	2780	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1160 set thread context of 2836	1160	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2816 set thread context of 1568	2816	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2068 set thread context of 2604	2068	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2768 set thread context of 836	2768	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2456 set thread context of 2536	2456	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2228 set thread context of 2896	2228	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2868 set thread context of 1992	2868	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2280 set thread context of 2272	2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1572 set thread context of 1672	1572	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1612 set thread context of 1104	1612	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 584 set thread context of 2224	584	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1088 set thread context of 2260	1088	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1308 set thread context of 1756	1308	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2740 set thread context of 2912	2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 348 set thread context of 2392	348	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2980 set thread context of 2816	2980	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2192 set thread context of 2632	2192	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2400 set thread context of 2676	2400	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1904 set thread context of 2388	1904	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1652 set thread context of 3048	1652	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2608 set thread context of 628	2608	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1876 set thread context of 1332	1876	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1028 set thread context of 452	1028	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2708 set thread context of 1676	2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 764 set thread context of 2624	764	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2956 set thread context of 2456	2956	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1900 set thread context of 2696	1900	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2372 set thread context of 1192	2372	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1636 set thread context of 2704	1636	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2124 set thread context of 788	2124	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1932 set thread context of 2216	1932	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1652 set thread context of 1668	1652	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1544 set thread context of 876	1544	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1580 set thread context of 1700	1580	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1504 set thread context of 2308	1504	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1956 set thread context of 2768	1956	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2740 set thread context of 1112	2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 3028 set thread context of 2024	3028	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1420 set thread context of 1948	1420	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2684 set thread context of 1540	2684	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 988 set thread context of 852	988	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1508 set thread context of 2556	1508	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1616 set thread context of 592	1616	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 1812 set thread context of 1652	1812	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 276 set thread context of 1012	276	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 848 set thread context of 2780	848	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2912 set thread context of 2536	2912	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2044 set thread context of 2452	2044	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe

Drops file in Program Files directory 2 IoCs

Processes:

RegAsm.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	RegAsm.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

pid	process
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

1796 RegAsm.exe

pid	process
1796	RegAsm.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

pid	process
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2024	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2680	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2320	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1020	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1672	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1672	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
628	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2036	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2212	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1480	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1480	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1876	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2208	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2168	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2780	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1160	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1160	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2816	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2068	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2768	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2456	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2228	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2868	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1572	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1612	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1612	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1612	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
584	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1088	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1308	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
348	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2980	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2192	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2192	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2400	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1904	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1904	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1652	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1652	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2608	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1876	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
1028	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exeRegAsm.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1796	RegAsm.exe
Token: SeDebugPrivilege	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2024	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2680	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2320	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1020	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1672	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	628	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2036	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2212	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1480	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1876	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2208	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2168	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2780	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1160	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2816	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2068	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2768	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2456	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2228	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2868	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2280	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1572	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1612	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	584	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1088	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1308	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	348	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2980	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2192	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2400	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1904	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1652	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2608	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1876	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1028	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2708	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	764	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2956	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1900	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2372	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1636	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2124	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1932	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1652	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1544	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1580	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1504	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1956	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2740	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	3028	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1420	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2684	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	988	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1508	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1616	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	1812	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	276	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	848	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
Token: SeDebugPrivilege	2912	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

description	pid	process	target process
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2076	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 3028	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2656	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 1796	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 840 wrote to memory of 2528	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 840 wrote to memory of 2528	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 840 wrote to memory of 2528	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 840 wrote to memory of 2528	840	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2588	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2528 wrote to memory of 2548	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2528 wrote to memory of 2548	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2528 wrote to memory of 2548	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2528 wrote to memory of 2548	2528	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2400	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2144	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	RegAsm.exe
PID 2548 wrote to memory of 2024	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2548 wrote to memory of 2024	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2548 wrote to memory of 2024	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
PID 2548 wrote to memory of 2024	2548	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe	58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:344

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:2708

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:764

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:2264

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
PID:308

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
PID:2804

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
PID:2836

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
18⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
PID:836

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:2284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:2848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:2272

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
26⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
PID:988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
PID:720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
PID:1104

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
PID:2224

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
28⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
29⤵
PID:2260

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
PID:1756

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
30⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:3000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
32⤵
PID:2392

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
32⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:2816

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:2468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
35⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
36⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:3048

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
37⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
38⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:1332

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
39⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:452

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
40⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:2948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:2984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:2724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
41⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
42⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
42⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
43⤵
PID:2456

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
43⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:1288

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
44⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
45⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
45⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
46⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
48⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
48⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
49⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
49⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:876

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
50⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
PID:1700

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:1028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
54⤵
PID:1112

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:2920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:2652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
59⤵
PID:2556

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:1188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:1500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:1944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:592

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:2176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:1012

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
63⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:2060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:1504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
64⤵
- Suspicious use of SetThreadContext
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:2368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
65⤵
PID:2856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:760

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
66⤵
PID:2628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
67⤵
PID:1476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
67⤵
PID:1020

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
67⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
68⤵
PID:2284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
68⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
68⤵
PID:1392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:2700

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
69⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
70⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
70⤵
PID:2800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
71⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
71⤵
PID:2972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
72⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
72⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
73⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
73⤵
PID:1892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
74⤵
PID:1544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
74⤵
PID:2076

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
74⤵
PID:2120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
75⤵
PID:1580

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
75⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
76⤵
PID:2280

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
76⤵
PID:2396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:880

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
77⤵
PID:1672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
78⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
78⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
79⤵
PID:2628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
80⤵
PID:788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
80⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
80⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
81⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
81⤵
PID:1820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
82⤵
PID:1104

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
82⤵
PID:2484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
83⤵
PID:2016

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
83⤵
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:2972

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
84⤵
PID:1504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
85⤵
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
86⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
86⤵
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
87⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
87⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
88⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
88⤵
PID:2384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:2396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:672

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
89⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:1244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
90⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:1368

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
91⤵
PID:2608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
92⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
93⤵
PID:2252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
93⤵
PID:312

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
93⤵
PID:2744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
94⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
94⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
95⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
95⤵
PID:2436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:3036

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
96⤵
PID:452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:1952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:2024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
97⤵
PID:2852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
98⤵
PID:360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
98⤵
PID:412

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
98⤵
PID:2544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
99⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
99⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
100⤵
PID:1088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
101⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
101⤵
PID:2364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
102⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
102⤵
PID:2164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
103⤵
PID:2688

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
103⤵
PID:3048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
104⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
104⤵
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
105⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
105⤵
PID:2352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
106⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
107⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
107⤵
PID:2448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
108⤵
PID:320

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
108⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
109⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
110⤵
PID:908

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
110⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
111⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
111⤵
PID:1680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
112⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
112⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
113⤵
PID:336

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
113⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
114⤵
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
114⤵
PID:2432

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
114⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
115⤵
PID:1088

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
115⤵
PID:1608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
116⤵
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
116⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
116⤵
PID:2392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
117⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
118⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
118⤵
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:2956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:3000

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
119⤵
PID:1348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
120⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
120⤵
PID:2004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:2792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
121⤵
PID:2728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
122⤵
PID:1432

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
122⤵
PID:2436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
123⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
123⤵
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
124⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
124⤵
PID:312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:2940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
125⤵
PID:308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
126⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
126⤵
PID:2444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
127⤵
PID:1820

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
127⤵
PID:564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
128⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
128⤵
PID:2716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
129⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
129⤵
PID:2392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
130⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
130⤵
PID:2708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
131⤵
PID:412

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
131⤵
PID:2292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
132⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
132⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
133⤵
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
133⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
133⤵
PID:2060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
134⤵
PID:2804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
135⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
135⤵
PID:980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:2296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
136⤵
PID:276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
137⤵
PID:2264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
137⤵
PID:1680

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
137⤵
PID:1500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
138⤵
PID:2364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
138⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
138⤵
PID:2320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
139⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
139⤵
PID:1308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
140⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
140⤵
PID:772

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
140⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
141⤵
PID:352

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
141⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:1780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:2884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
142⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
143⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
143⤵
PID:1900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
144⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
144⤵
PID:2760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:2100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
145⤵
PID:2948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
146⤵
PID:2836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
146⤵
PID:884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
146⤵
PID:2852

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
146⤵
PID:2016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
147⤵
PID:312

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
147⤵
PID:2868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
148⤵
PID:1416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
149⤵
PID:592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
149⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
149⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:1040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:2720

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
150⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
151⤵
PID:344

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
151⤵
PID:2252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
152⤵
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
153⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
153⤵
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:1160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
154⤵
PID:760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:1272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
155⤵
PID:2004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
156⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
156⤵
PID:2260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
157⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
157⤵
PID:1356

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
157⤵
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
158⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
158⤵
PID:868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
159⤵
PID:1320

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
159⤵
PID:1804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
160⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
160⤵
PID:2944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
160⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
160⤵
PID:1744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
161⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
161⤵
PID:1316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
162⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
162⤵
PID:348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
163⤵
PID:1328

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
163⤵
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
164⤵
PID:672

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
164⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
165⤵
PID:2040

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
165⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
166⤵
PID:2372

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
166⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:1888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:2836

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
167⤵
PID:1280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
168⤵
PID:2436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
168⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
168⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
169⤵
PID:2464

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
169⤵
PID:1012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:2216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:2692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
170⤵
PID:2168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
171⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
171⤵
PID:1000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:2236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
172⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:1612

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
173⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
174⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
175⤵
PID:564

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
175⤵
PID:2308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
176⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:760

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
177⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
178⤵
PID:1516

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
178⤵
PID:1748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
179⤵
PID:2276

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
179⤵
PID:2612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:2944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:1812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
180⤵
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:2656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:2264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:2092

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
181⤵
PID:1720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
182⤵
PID:1700

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
182⤵
PID:2348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
183⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
183⤵
PID:2472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
184⤵
PID:2900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
184⤵
PID:2832

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
184⤵
PID:568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
185⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
185⤵
PID:2740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
186⤵
PID:2776

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
186⤵
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
187⤵
PID:336

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
187⤵
PID:2284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
188⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
188⤵
PID:2684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
189⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
189⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
190⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
190⤵
PID:2432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
191⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
191⤵
PID:2656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
192⤵
PID:584

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
192⤵
PID:2444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
193⤵
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
193⤵
PID:2848

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
193⤵
PID:1940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
194⤵
PID:1472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
194⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
194⤵
PID:2348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
195⤵
PID:2972

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
195⤵
PID:2652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:1328

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
196⤵
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
197⤵
PID:2468

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
197⤵
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
198⤵
PID:2120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
198⤵
PID:2852

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
198⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:2492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
199⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
200⤵
PID:2880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
201⤵
PID:2460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
201⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
201⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
202⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
202⤵
PID:1968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
203⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
203⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
204⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
204⤵
PID:2444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
205⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
205⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
206⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
206⤵
PID:1368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
207⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
207⤵
PID:2652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
208⤵
PID:360

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
208⤵
PID:672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
209⤵
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
210⤵
PID:2392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:1548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
211⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
212⤵
PID:2872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
212⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
212⤵
PID:2720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
213⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
213⤵
PID:1284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
214⤵
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
215⤵
PID:1952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
215⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
215⤵
PID:2252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
216⤵
PID:1916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
216⤵
PID:1848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
216⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
216⤵
PID:2820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
217⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
217⤵
PID:1368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
218⤵
PID:1376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
218⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
218⤵
PID:2688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
219⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
219⤵
PID:1632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
220⤵
PID:2944

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
220⤵
PID:944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
221⤵
PID:2880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
221⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
221⤵
PID:1416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
222⤵
PID:2272

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
222⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
223⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
223⤵
PID:840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
224⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
224⤵
PID:1580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
224⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
224⤵
PID:1904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
225⤵
PID:1820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
225⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
225⤵
PID:2848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
226⤵
PID:2816

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
226⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
227⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
227⤵
PID:2548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
228⤵
PID:2388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
228⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
228⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
229⤵
PID:1908

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
229⤵
PID:2024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
230⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
230⤵
PID:852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
230⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
230⤵
PID:2160

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
230⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
231⤵
PID:1432

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
231⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
232⤵
PID:1348

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
232⤵
PID:2464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
233⤵
PID:2004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
233⤵
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
233⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
233⤵
PID:2416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
234⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
234⤵
PID:2672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
235⤵
PID:2296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
235⤵
PID:2484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
235⤵
PID:1680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
235⤵
PID:2592

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
235⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
236⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
236⤵
PID:2884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
237⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
237⤵
PID:1948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
238⤵
PID:2060

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
238⤵
PID:2716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
239⤵
PID:836

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
239⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
240⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
240⤵
PID:2392

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
240⤵
PID:824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:2772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:2660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:336

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
241⤵
PID:848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
242⤵
PID:2080

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
242⤵
PID:348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
243⤵
PID:2004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
243⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
243⤵
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
244⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
244⤵
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
245⤵
PID:2484

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
245⤵
PID:2416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
246⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
246⤵
PID:752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
247⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
247⤵
PID:760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
248⤵
PID:2752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
248⤵
PID:1376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
248⤵
PID:2044

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
248⤵
PID:2780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
249⤵
PID:672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
249⤵
PID:1784

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
249⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
250⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
250⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
250⤵
PID:1272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
251⤵
PID:1368

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
251⤵
PID:2540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
252⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
252⤵
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
253⤵
PID:1504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
253⤵
PID:2272

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
253⤵
PID:848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
254⤵
PID:2856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
254⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
254⤵
PID:2276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
255⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
255⤵
PID:3060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
256⤵
PID:2164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
256⤵
PID:2000

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
256⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
257⤵
PID:320

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
257⤵
PID:3008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
258⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
258⤵
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
259⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
259⤵
PID:1548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:2972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
260⤵
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
261⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
261⤵
PID:360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
262⤵
PID:1432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
262⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
262⤵
PID:2684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
263⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
263⤵
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
264⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
264⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
265⤵
PID:2236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
265⤵
PID:2720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
265⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
265⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
265⤵
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
266⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
266⤵
PID:2940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
267⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
267⤵
PID:1320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
268⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
268⤵
PID:2216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
269⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
269⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
269⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
269⤵
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
270⤵
PID:1980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
270⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
270⤵
PID:1252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
271⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
271⤵
PID:2316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
272⤵
PID:2124

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
272⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
273⤵
PID:2532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
273⤵
PID:2392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
273⤵
PID:1568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
273⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
273⤵
PID:756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
274⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
274⤵
PID:2144

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
275⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
275⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
275⤵
PID:2804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
276⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
276⤵
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
277⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
277⤵
PID:2068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
277⤵
PID:452

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
277⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
278⤵
PID:2320

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
278⤵
PID:2960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
279⤵
PID:1428

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
279⤵
PID:2024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
280⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
280⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
281⤵
PID:1328

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
281⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
281⤵
PID:2500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
282⤵
PID:3028

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
282⤵
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
283⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
283⤵
PID:1432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
284⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
284⤵
PID:2080

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
284⤵
PID:908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
285⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
285⤵
PID:756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
286⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
286⤵
PID:1416

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
286⤵
PID:2544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
287⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
287⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
288⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
288⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
289⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
289⤵
PID:880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
290⤵
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
290⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
290⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
291⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
291⤵
PID:1088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
292⤵
PID:2740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
292⤵
PID:1104

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
292⤵
PID:2324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
293⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
293⤵
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
294⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
294⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
295⤵
PID:2584

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
295⤵
PID:1268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
296⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
296⤵
PID:2720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
297⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
297⤵
PID:2168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
298⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
298⤵
PID:848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
299⤵
PID:2292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
299⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
299⤵
PID:2796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
300⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
300⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
301⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
301⤵
PID:1288

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
302⤵
PID:2304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
302⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
302⤵
PID:1420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
303⤵
PID:344

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
303⤵
PID:852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
304⤵
PID:1012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
304⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
304⤵
PID:760

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
304⤵
PID:1676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
305⤵
PID:1744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
305⤵
PID:844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
305⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
305⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
306⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
306⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
307⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
307⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
308⤵
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
308⤵
PID:1580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
308⤵
PID:1052

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
308⤵
PID:1952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
309⤵
PID:592

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
309⤵
PID:2868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
310⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
310⤵
PID:2008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
311⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
311⤵
PID:1520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
312⤵
PID:2424

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
312⤵
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
313⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
313⤵
PID:2020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
314⤵
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
314⤵
PID:2312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
314⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
314⤵
PID:2800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
315⤵
PID:2392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
315⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
315⤵
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
315⤵
PID:872

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
315⤵
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
316⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
316⤵
PID:1968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
317⤵
PID:2080

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
317⤵
PID:2448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
318⤵
PID:804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
318⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
318⤵
PID:1548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
318⤵
PID:1040

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
318⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
319⤵
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
319⤵
PID:1188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
319⤵
PID:1564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
319⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
319⤵
PID:2212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
320⤵
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
320⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
320⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
321⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
321⤵
PID:3056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
322⤵
PID:1332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
322⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
322⤵
PID:2804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
323⤵
PID:320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
323⤵
PID:1316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
323⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
323⤵
PID:1484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
324⤵
PID:2736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
324⤵
PID:2408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
324⤵
PID:2416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
324⤵
PID:348

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
324⤵
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
325⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
325⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
325⤵
PID:2304

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
325⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
326⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
326⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
327⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
327⤵
PID:1700

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
327⤵
PID:1608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
328⤵
PID:2668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
328⤵
PID:2540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
328⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
328⤵
PID:2812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
329⤵
PID:824

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
329⤵
PID:1760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
330⤵
PID:1764

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
330⤵
PID:1620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
331⤵
PID:2292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
331⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
331⤵
PID:1124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
332⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
332⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
332⤵
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
333⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
333⤵
PID:1732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
334⤵
PID:2620

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
334⤵
PID:2452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
335⤵
PID:2140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
335⤵
PID:2384

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
335⤵
PID:1996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
336⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
336⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
336⤵
PID:2368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
337⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
337⤵
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
337⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
337⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
338⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
338⤵
PID:2240

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
338⤵
PID:900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
339⤵
PID:2260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
339⤵
PID:2236

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
339⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
340⤵
PID:2664

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
340⤵
PID:1608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
341⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
341⤵
PID:2216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
342⤵
PID:2064

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
342⤵
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
343⤵
PID:324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
343⤵
PID:848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
343⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
343⤵
PID:1696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
344⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
344⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
344⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
344⤵
PID:1812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
345⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
345⤵
PID:2640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
346⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
346⤵
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
347⤵
PID:2192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
347⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
347⤵
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
348⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
348⤵
PID:276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
349⤵
PID:2260

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
349⤵
PID:1568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
350⤵
PID:1840

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
350⤵
PID:944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
351⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
351⤵
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
352⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
352⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
352⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
352⤵
PID:3056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
353⤵
PID:2212

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
353⤵
PID:1052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
354⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
354⤵
PID:1032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
355⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
355⤵
PID:2252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
355⤵
PID:2100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
355⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
355⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
356⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
356⤵
PID:2452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
357⤵
PID:1848

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
357⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
358⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
358⤵
PID:2264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
359⤵
PID:2412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
359⤵
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
359⤵
PID:308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
359⤵
PID:2532

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
359⤵
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
360⤵
PID:1564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
360⤵
PID:2516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
360⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
360⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
361⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
361⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
362⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
362⤵
PID:2216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
363⤵
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
363⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
363⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
363⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:1736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:2408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:2588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:2724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:1756

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
364⤵
PID:808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
365⤵
PID:2272

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
365⤵
PID:2404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
366⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
366⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
367⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
367⤵
PID:1768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
368⤵
PID:3028

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
368⤵
PID:1048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
369⤵
PID:2776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
369⤵
PID:804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
369⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
369⤵
PID:880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
370⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
370⤵
PID:2004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
371⤵
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
371⤵
PID:1432

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
371⤵
PID:2308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
372⤵
PID:2076

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
372⤵
PID:1948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
373⤵
PID:3056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
373⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
373⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
374⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
374⤵
PID:944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
375⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
375⤵
PID:756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
376⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
376⤵
PID:2608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
377⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
377⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
377⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
378⤵
PID:2572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
378⤵
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
378⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
378⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
379⤵
PID:2220

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
379⤵
PID:2672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
380⤵
PID:2796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
380⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
380⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
381⤵
PID:2068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
381⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
381⤵
PID:2384

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
381⤵
PID:1600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
382⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
382⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
383⤵
PID:1344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
383⤵
PID:1996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
383⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
383⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
384⤵
PID:2248

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
384⤵
PID:2848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
385⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
385⤵
PID:2236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
386⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
386⤵
PID:2592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
387⤵
PID:2816

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
387⤵
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
388⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58a37ded7d1b1f73f58bd17008e0876f_JaffaCakes118.exe"
388⤵
PID:2604

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-13-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/840-3-0x00000000004D0000-0x0000000000558000-memory.dmp

Filesize
544KB

Download
memory/840-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/840-2-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/840-4-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/840-1-0x0000000000CC0000-0x0000000000E42000-memory.dmp

Filesize
1.5MB

Download
memory/1796-27-0x0000000000CA0000-0x0000000000CCE000-memory.dmp

Filesize
184KB

Download
memory/1796-5-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1796-7-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1796-9-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1796-18-0x0000000000780000-0x000000000079A000-memory.dmp

Filesize
104KB

Download
memory/1796-17-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/1796-20-0x00000000008B0000-0x00000000008C4000-memory.dmp

Filesize
80KB

Download
memory/1796-19-0x00000000008A0000-0x00000000008AE000-memory.dmp

Filesize
56KB

Download
memory/1796-22-0x0000000000AB0000-0x0000000000ACE000-memory.dmp

Filesize
120KB

Download
memory/1796-21-0x0000000000A60000-0x0000000000A6E000-memory.dmp

Filesize
56KB

Download
memory/1796-23-0x0000000000B60000-0x0000000000B6A000-memory.dmp

Filesize
40KB

Download
memory/1796-28-0x0000000000B80000-0x0000000000B94000-memory.dmp

Filesize
80KB

Download
memory/1796-16-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads