f37534f4fa518cf893d397f596c450de1583e25696e7a8fbc2ef691b0e87f78c

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
Size

192KB
MD5

178572e4d86614d464edb0c49aed1865
SHA1

2873bb6205208d2996ff657a6dcd904e6beb5958
SHA256

f37534f4fa518cf893d397f596c450de1583e25696e7a8fbc2ef691b0e87f78c
SHA512

1b4fbd58425bfc8e179ead7259d33cf6df440e905beeb580ee97e40859e40e20662b13b6bc4ce89dc8f3e0f8f3ae98be17cec20c81d62429863e94d09d08ed4e
SSDEEP

3072:mKb5zN9u8StaSRnYkOlzbG9/ZZADT7ONPGzXwTFKEG4ne8svUqnvjy:md4ShcGhZ+T74PZFLQ/ve

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2412	commserv.exe
1984	commserv.exe
2624	commserv.exe
2760	commserv.exe
2740	commserv.exe
2892	commserv.exe
2864	commserv.exe
2636	commserv.exe
2476	commserv.exe
2380	commserv.exe
2340	commserv.exe
1256	commserv.exe
2720	commserv.exe
2804	commserv.exe
1352	commserv.exe
1776	commserv.exe
1536	commserv.exe
108	commserv.exe
1112	commserv.exe
1192	commserv.exe
2044	commserv.exe
1240	commserv.exe
2988	commserv.exe
2852	commserv.exe
2000	commserv.exe
1960	commserv.exe
2840	commserv.exe
980	commserv.exe
924	commserv.exe
1724	commserv.exe
1428	commserv.exe
2100	commserv.exe
1088	commserv.exe
2376	commserv.exe
1208	commserv.exe
956	commserv.exe
2112	commserv.exe
2144	commserv.exe
656	commserv.exe
2180	commserv.exe
2276	commserv.exe
2124	commserv.exe
2920	commserv.exe
1728	commserv.exe
2884	commserv.exe
2244	commserv.exe
1496	commserv.exe
2412	commserv.exe
2556	commserv.exe
2028	commserv.exe
2668	commserv.exe
2748	commserv.exe
2740	commserv.exe
2652	commserv.exe
2776	commserv.exe
2504	commserv.exe
2636	commserv.exe
2496	commserv.exe
2520	commserv.exe
3016	commserv.exe
1976	commserv.exe
1256	commserv.exe
2800	commserv.exe
2732	commserv.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\commserv.exe	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1860	2248	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	29
PID 2248 wrote to memory of 1860	2248	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	29
PID 2248 wrote to memory of 1860	2248	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	29
PID 2248 wrote to memory of 1860	2248	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2608	1860	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2608	1860	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2608	1860	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2608	1860	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	31
PID 2608 wrote to memory of 2708	2608	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	33
PID 2608 wrote to memory of 2708	2608	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	33
PID 2608 wrote to memory of 2708	2608	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	33
PID 2608 wrote to memory of 2708	2608	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	33
PID 2708 wrote to memory of 2216	2708	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	35
PID 2708 wrote to memory of 2216	2708	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	35
PID 2708 wrote to memory of 2216	2708	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	35
PID 2708 wrote to memory of 2216	2708	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2176	2216	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2176	2216	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2176	2216	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2176	2216	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2500	2176	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2500	2176	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2500	2176	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2500	2176	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	39
PID 2500 wrote to memory of 2684	2500	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	41
PID 2500 wrote to memory of 2684	2500	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	41
PID 2500 wrote to memory of 2684	2500	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	41
PID 2500 wrote to memory of 2684	2500	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	41
PID 2684 wrote to memory of 2520	2684	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	43
PID 2684 wrote to memory of 2520	2684	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	43
PID 2684 wrote to memory of 2520	2684	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	43
PID 2684 wrote to memory of 2520	2684	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	43
PID 2520 wrote to memory of 2528	2520	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	45
PID 2520 wrote to memory of 2528	2520	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	45
PID 2520 wrote to memory of 2528	2520	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	45
PID 2520 wrote to memory of 2528	2520	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	45
PID 2528 wrote to memory of 2976	2528	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	47
PID 2528 wrote to memory of 2976	2528	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	47
PID 2528 wrote to memory of 2976	2528	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	47
PID 2528 wrote to memory of 2976	2528	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	47
PID 2976 wrote to memory of 1540	2976	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	49
PID 2976 wrote to memory of 1540	2976	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	49
PID 2976 wrote to memory of 1540	2976	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	49
PID 2976 wrote to memory of 1540	2976	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	49
PID 1540 wrote to memory of 2732	1540	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	51
PID 1540 wrote to memory of 2732	1540	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	51
PID 1540 wrote to memory of 2732	1540	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	51
PID 1540 wrote to memory of 2732	1540	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	51
PID 2732 wrote to memory of 2648	2732	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	53
PID 2732 wrote to memory of 2648	2732	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	53
PID 2732 wrote to memory of 2648	2732	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	53
PID 2732 wrote to memory of 2648	2732	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	53
PID 2648 wrote to memory of 2552	2648	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	55
PID 2648 wrote to memory of 2552	2648	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	55
PID 2648 wrote to memory of 2552	2648	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	55
PID 2648 wrote to memory of 2552	2648	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	55
PID 2552 wrote to memory of 1260	2552	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	57
PID 2552 wrote to memory of 1260	2552	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	57
PID 2552 wrote to memory of 1260	2552	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	57
PID 2552 wrote to memory of 1260	2552	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	57
PID 1260 wrote to memory of 1712	1260	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	59
PID 1260 wrote to memory of 1712	1260	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	59
PID 1260 wrote to memory of 1712	1260	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	59
PID 1260 wrote to memory of 1712	1260	178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe	59

C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
  a
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
    a
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
      a
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        10⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        17⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        18⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        19⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        20⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        21⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        22⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        23⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        24⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        25⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        26⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        27⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        28⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        29⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        30⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        31⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        32⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        33⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        34⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        35⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        36⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        37⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        38⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        39⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        40⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        41⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        42⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        43⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        44⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        45⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        46⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        47⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        48⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        49⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        50⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        51⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        52⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        53⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        54⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        55⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        56⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        57⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        58⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        59⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        60⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        61⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        62⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        63⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        64⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        65⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        66⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        67⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        68⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        69⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        70⤵
        Drops file in System32 directory
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        71⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        72⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        73⤵
        Drops file in System32 directory
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        74⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        75⤵
        Drops file in System32 directory
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        76⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        77⤵
        Drops file in System32 directory
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        78⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        79⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        80⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        81⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        82⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        83⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        84⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        85⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        86⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        87⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        88⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        89⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        90⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        91⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        92⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        93⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        94⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        95⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        96⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        97⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        98⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        99⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        100⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        101⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        102⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        103⤵
        Drops file in System32 directory
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        104⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        105⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        106⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        107⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        108⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        109⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        110⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        111⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        112⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        113⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        114⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        115⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        116⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        117⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        118⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        119⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        120⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        121⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        122⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        123⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        124⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        125⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        126⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        127⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        128⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        129⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        130⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        131⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        132⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        133⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        134⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        135⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        136⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        137⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        138⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        139⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        140⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        141⤵
        Drops file in System32 directory
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        142⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        143⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        144⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        145⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        146⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        147⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        148⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        149⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        150⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        151⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        152⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        153⤵
        Drops file in System32 directory
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        154⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        155⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        156⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        157⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        158⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        159⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        160⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        161⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        162⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        163⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        164⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        165⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        166⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        167⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        168⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        169⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        170⤵
        Drops file in System32 directory
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        171⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        172⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        173⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        174⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        175⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        176⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        177⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        178⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        179⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        180⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        181⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        182⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        183⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        184⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        185⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        186⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        187⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        188⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        189⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        190⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        191⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        192⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        193⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        194⤵
        Drops file in System32 directory
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        195⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        196⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        197⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        198⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        199⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        200⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        201⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        202⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        203⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        204⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        205⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        206⤵
        Drops file in System32 directory
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        207⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        208⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        209⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        210⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        211⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        212⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        213⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        214⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        215⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        216⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        217⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        218⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        219⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        220⤵
        Drops file in System32 directory
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        221⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        222⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        223⤵
        Drops file in System32 directory
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        224⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        225⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        226⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        227⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        228⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        229⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        230⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        231⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        232⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        233⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        234⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        235⤵
        Drops file in System32 directory
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        236⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        237⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        238⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        239⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        240⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        241⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        242⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        243⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        244⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        245⤵
        Drops file in System32 directory
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        246⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        247⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        248⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        249⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        250⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        251⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        252⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        253⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        254⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        255⤵
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        256⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        257⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        258⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        259⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        260⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        261⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        262⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        263⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        264⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        265⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        266⤵
        Drops file in System32 directory
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        267⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        268⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        269⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        270⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        271⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        272⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        273⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        274⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        275⤵
        Drops file in System32 directory
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        276⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        277⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        278⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        279⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        280⤵
        Drops file in System32 directory
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        281⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        282⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        283⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        284⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        285⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        286⤵
        Drops file in System32 directory
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        287⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        288⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        289⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        290⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        291⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        292⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        293⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        294⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        295⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        296⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        297⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        298⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        299⤵
        Drops file in System32 directory
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        300⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        301⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        302⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        303⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        304⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        305⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        306⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        307⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        308⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        309⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        310⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        311⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        312⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        313⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        314⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        315⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        316⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        317⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        318⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        319⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        320⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        321⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        322⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        323⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        324⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        325⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        326⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        327⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        328⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        329⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        330⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        331⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        332⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        333⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        334⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        335⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        336⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        337⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        338⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        339⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        340⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        341⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        342⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        343⤵
        Drops file in System32 directory
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        344⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        345⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        346⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        347⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        348⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        349⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        350⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        351⤵
        Drops file in System32 directory
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        352⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        353⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        354⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        355⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        356⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        357⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        358⤵
        Drops file in System32 directory
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        359⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        360⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        361⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        362⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        363⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        364⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        365⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        366⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        367⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        368⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        369⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        370⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        371⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        372⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        373⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        374⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        375⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        376⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        377⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        378⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        379⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        380⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        381⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        382⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        383⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        384⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        385⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        386⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        387⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        388⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        389⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        390⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        391⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        392⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        393⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        394⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        395⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        396⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        397⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        398⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        399⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        400⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        401⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        402⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        403⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        404⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        405⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        406⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        407⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        408⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        409⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        410⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        411⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        412⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        413⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        414⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        415⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        416⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        417⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        418⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        419⤵
        Drops file in System32 directory
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        420⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        421⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        422⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        423⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        424⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        425⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        426⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        427⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        428⤵
        Drops file in System32 directory
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        429⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        430⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        431⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        432⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        433⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        434⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        435⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        436⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        437⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        438⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        439⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        440⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        441⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        442⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        443⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        444⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        445⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        446⤵
        Drops file in System32 directory
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        447⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        448⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        449⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        450⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        451⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        452⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        453⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        454⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        455⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        456⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        457⤵
        Drops file in System32 directory
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        458⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        459⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        460⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        461⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        462⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        463⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        464⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        465⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        466⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        467⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        468⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        469⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        470⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        471⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        472⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        473⤵
        Drops file in System32 directory
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        474⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        475⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        476⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        477⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        478⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        479⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        480⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        481⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        482⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        483⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        484⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        485⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        486⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        487⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        488⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        489⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        490⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        491⤵
        Drops file in System32 directory
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        492⤵
        Drops file in System32 directory
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        493⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        494⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        495⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        496⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        497⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        498⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        499⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        500⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        501⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        502⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        503⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        504⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        505⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        506⤵
        Drops file in System32 directory
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        507⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        508⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        509⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        510⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        511⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\178572e4d86614d464edb0c49aed1865_JaffaCakes118.exe
        
        a
        512⤵
        
        PID:2508

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2624

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2892

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2476

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2804

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1352

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1776

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1192

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2044

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1240

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2988

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:980

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:924

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1428

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:956

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2124

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2244

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2872

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1352

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1784

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1584

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2108

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:304

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1760

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1012

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2152

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1020

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2016

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2988

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1596

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2952

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1996

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1928

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2840

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:908

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2212

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:584

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1048

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1720

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1552

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:448

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:792

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2376

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1208

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:956

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2112

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2144

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2276

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2124

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2920

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1728

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2884

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2244

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1624

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1896

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2424

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1636

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2596

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2672

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2896

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2628

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2176

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2192

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2580

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2480

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2372

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2528

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1228

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:904

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2720

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2796

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2648

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1432

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1776

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1764

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2116

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2364

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1356

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2836

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1108

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1620

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2316

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1680

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1908

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1948

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2560

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2448

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:388

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1408

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:924

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2844

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:576

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1920

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:684

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2100

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1692

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2916

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1304

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:352

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1820

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1940

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:688

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2228

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2120

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:564

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1612

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1968

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1424

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2092

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:872

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1732

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2256

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3064

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2700

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2216

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2692

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2612

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2584

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2500

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2640

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2684

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2516

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2540

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2712

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2724

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1540

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2808

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2788

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1592

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:984

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2824

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1780

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1464

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:996

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:856

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:840

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2052

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2984

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2964

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2952

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1996

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2268

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:336

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2940

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:676

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:476

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:292

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1172

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1552

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:492

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:824

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2128

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:748

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1288

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:768

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1868

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2276

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2124

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2920

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2072

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1468

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:940

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1864

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1860

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2680

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1984

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2572

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2620

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2708

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2472

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2176

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2192

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2460

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2604

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2372

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2528

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1228

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2532

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2636

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2796

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2648

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1772

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2552

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1764

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2116

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2364

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1356

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2152

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1240

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2232

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1268

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2868

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2860

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1908

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1948

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2560

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1224

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:584

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1048

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2816

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2360

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:572

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1920

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2200

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2212

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1692

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1500

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1888

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:352

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1820

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1940

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1568

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2148

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1208

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:564

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2160

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1588

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1424

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2092

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1864

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1856

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3044

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2668

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2748

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2688

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2556

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2612

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2828

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2632

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2512

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2468

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2536

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1976

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2540

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2720

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2812

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2780

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1352

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2804

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1756

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1712

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2824

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1192

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2032

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1020

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1204

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2852

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2012

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2964

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2952

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:320

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1576

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1400

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:388

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1408

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1724

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:744

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1172

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:988

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:492

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:824

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1532

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1556

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1132

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:804

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2144

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:344

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2276

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2124

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:876

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1548

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1468

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1608

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3048

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2624

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3044

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2668

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2748

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2688

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2556

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2612

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2828

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2632

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2512

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2588

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2288

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2516

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1572

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1432

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1776

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1536

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1476

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:108

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1028

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1780

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2836

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2368

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2016

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2988

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2388

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1680

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1944

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:552

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2040

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2448

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:336

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:764

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:476

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2844

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:576

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:780

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1088

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1552

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2272

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2916

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1304

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1292

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:696

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:888

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:688

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:296

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2252

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1768

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1612

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2920

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2884

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1516

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:872

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2196

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1860

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1904

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3064

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2700

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2744

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1632

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2752

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2176

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2192

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2460

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2468

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1256

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1976

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2780

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2788

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2804

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2280

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1712

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2824

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1192

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2032

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:996

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:856

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2852

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2984

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:532

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1924

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:320

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2268

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2420

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:700

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:924

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1724

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:292

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:408

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:988

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1480

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:792

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1532

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1672

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1288

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1604

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1816

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2060

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2664

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2140

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2208

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1968

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1496

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1560

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2412

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1896

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2028

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2760

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2740

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2748

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2708

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2492

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2828

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2520

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2972

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2588

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2288

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2516

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1540

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2808

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1784

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1756

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1476

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1492

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1544

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2716

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1464

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:996

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:856

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2852

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2984

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:532

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1924

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:320

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2448

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2420

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:700

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:924

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1724

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:292

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:408

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2656

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:988

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1480

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:792

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1532

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1672

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1288

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1604

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:688

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:296

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2120

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:880

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1668

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1136

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2160

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1624

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:872

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:1732

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2624

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2760

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2740

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2748

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2708

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2492

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:3024

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2828

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2520

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2972

C:\Windows\SysWOW64\commserv.exe
C:\Windows\SysWOW64\commserv.exe
1⤵
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\commserv.exe

Filesize
124KB

MD5
01201ed072a39c34f21b15b604a9dcd8

SHA1
4761df28afbaa31e32dad6e96c58c9e8eeccdd13

SHA256
a5345fdfc98f7fa340775d0ca5c370b0d8446ee3d5a258979be2a0818b51ba30

SHA512
7532854d6d89c5259b71380eaf32d552e7d9523721536557b84567a5feaa5e0a6ef33e9e1629fbf7c8e6b00f1dd8038a1872c3a5ea4ea1278d9bfb726675dd5b

Download Submit
memory/1864-571-0x0000000076D20000-0x0000000076E3F000-memory.dmp

Filesize
1.1MB

Download
memory/1864-572-0x0000000076E40000-0x0000000076F3A000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads