578f8da85bacb31c387bcaa2a3c38d803fda947b6f18e1176019d13dbdca2dec

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
Size

4.4MB
MD5

6755770ced0f41a960bbcfe699ea40b0
SHA1

60600656ed1811c2ddf47765f55ff2d42dd546cd
SHA256

578f8da85bacb31c387bcaa2a3c38d803fda947b6f18e1176019d13dbdca2dec
SHA512

c45e48efae1e423c86354d30177078673f3f3d6281ae75caf20bab5cf49fa2f8b5ca13934006491512ba33504185201d4aacf4110099df06881bf96db80c8e86
SSDEEP

98304:HkysAceYg/kDh8kIOkOEdaqlNFmGBBsgHm3NolDjXOwEsC:EysAc6s1IObEdDhYn3u

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2720	E936.tmp
2836	E957.tmp
2756	E956.tmp
2576	E984.tmp
620	E994.tmp
1224	E9D2.tmp
976	E9C3.tmp
2928	E9E2.tmp
1044	EA20.tmp
1620	E9B3.tmp
1268	EA11.tmp
1664	EA21.tmp
3028	EABD.tmp
2436	EAAD.tmp
3036	EABC.tmp
2420	EB0A.tmp
2000	EB1A.tmp
2264	EB49.tmp
1240	EB68.tmp
1340	EB69.tmp
1760	EB78.tmp
2488	EBE5.tmp
1660	EBD6.tmp
1524	EBD5.tmp
1156	EC33.tmp
3052	EC23.tmp
1756	EC52.tmp
2832	EC81.tmp
2692	ECBF.tmp
2612	ECDE.tmp
1828	ED0D.tmp
2632	ED4C.tmp
2624	ED7A.tmp
2792	ED9A.tmp
2236	EDC8.tmp
2764	EDE8.tmp
2124	EE16.tmp
408	EE45.tmp
2528	EE74.tmp
2088	EE93.tmp
2044	EEC2.tmp
2360	EEF1.tmp
2840	EF20.tmp
2712	EF4E.tmp
1508	EF6E.tmp
2676	EF9C.tmp
2056	EFCB.tmp
1532	EFEA.tmp
2148	F019.tmp
1780	F048.tmp
1564	F067.tmp
3104	F096.tmp
3140	F0C5.tmp
3184	F0E4.tmp
3228	F113.tmp
3288	F142.tmp
3308	F161.tmp
3344	F190.tmp
3404	F1BE.tmp
3436	F1ED.tmp
3468	F21C.tmp
3536	F26A.tmp
3572	F299.tmp
3640	F2D7.tmp

Loads dropped DLL 64 IoCs

pid	Process
2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2772	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2772	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2816	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2816	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2828	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2828	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2764	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2764	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2880	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2880	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2812	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2812	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2244	WerFault.exe
2244	WerFault.exe
2244	WerFault.exe
2732	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2732	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2684	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2684	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2872	WerFault.exe
2872	WerFault.exe
2872	WerFault.exe
1928	WerFault.exe
1928	WerFault.exe
1928	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
1688	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
1688	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2096	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2096	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2800	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2800	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2936	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2936	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
2200	WerFault.exe
2200	WerFault.exe
2200	WerFault.exe
1960	WerFault.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2572	2720	WerFault.exe	37
2288	2756	WerFault.exe
2744	2836	WerFault.exe
2200	1664	WerFault.exe
2400	3036	WerFault.exe
2444	3028	WerFault.exe	73
1824	2436	WerFault.exe
1960	1268	WerFault.exe
1036	1620	WerFault.exe
2892	1044	WerFault.exe
2004	2420	WerFault.exe	82
1928	2928	WerFault.exe
2184	976	WerFault.exe
2872	1224	WerFault.exe
2244	620	WerFault.exe
2852	2576	WerFault.exe	47
2524	2000	WerFault.exe	84
832	2264	WerFault.exe	86
2516	1240	WerFault.exe	90
2440	1340	WerFault.exe	91
2472	1760	WerFault.exe	94
1728	2488	WerFault.exe	101
236	1524	WerFault.exe	100
1724	1660	WerFault.exe	102
2316	1156	WerFault.exe
888	3052	WerFault.exe	107
3056	1756	WerFault.exe	111
1092	2832	WerFault.exe	116
2776	2692	WerFault.exe	117
2940	2612	WerFault.exe	120
288	1828	WerFault.exe	123
1480	2632	WerFault.exe	127
2880	2624	WerFault.exe	130
2076	2792	WerFault.exe	132
2812	2236	WerFault.exe	136
1636	2764	WerFault.exe	138
448	2124	WerFault.exe	142
952	408	WerFault.exe	145
2800	2528	WerFault.exe	147
1276	2088	WerFault.exe	150
840	2044	WerFault.exe	154
2536	2360	WerFault.exe	156
2476	2840	WerFault.exe	160
1932	2712	WerFault.exe	162
2952	1508	WerFault.exe	165
1652	2676	WerFault.exe	169
2192	2056	WerFault.exe	171
1684	1532	WerFault.exe	174
864	2148	WerFault.exe	178
1544	1780	WerFault.exe	180
3096	1564	WerFault.exe	183
3148	3104	WerFault.exe	187
3204	3140	WerFault.exe	189
3220	3184	WerFault.exe	192
3280	3228	WerFault.exe	196
3336	3288	WerFault.exe	199
3364	3308	WerFault.exe	201
3412	3344	WerFault.exe	204
3448	3404	WerFault.exe	207
3500	3436	WerFault.exe	210
3512	3468	WerFault.exe	212
3584	3536	WerFault.exe	217
3620	3572	WerFault.exe	219
3676	3640	WerFault.exe	223

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2668	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2668	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2668	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2668	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2768	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2768	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2768	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2768	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	32
PID 2768 wrote to memory of 2772	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	33
PID 2768 wrote to memory of 2772	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	33
PID 2768 wrote to memory of 2772	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	33
PID 2768 wrote to memory of 2772	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	33
PID 2772 wrote to memory of 2816	2772	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	34
PID 2772 wrote to memory of 2816	2772	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	34
PID 2772 wrote to memory of 2816	2772	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	34
PID 2772 wrote to memory of 2816	2772	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	34
PID 2816 wrote to memory of 2812	2816	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	35
PID 2816 wrote to memory of 2812	2816	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	35
PID 2816 wrote to memory of 2812	2816	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	35
PID 2816 wrote to memory of 2812	2816	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	35
PID 2812 wrote to memory of 2764	2812	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	36
PID 2812 wrote to memory of 2764	2812	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	36
PID 2812 wrote to memory of 2764	2812	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	36
PID 2812 wrote to memory of 2764	2812	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	36
PID 2704 wrote to memory of 2720	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	37
PID 2704 wrote to memory of 2720	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	37
PID 2704 wrote to memory of 2720	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	37
PID 2704 wrote to memory of 2720	2704	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	37
PID 2764 wrote to memory of 2828	2764	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	38
PID 2764 wrote to memory of 2828	2764	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	38
PID 2764 wrote to memory of 2828	2764	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	38
PID 2764 wrote to memory of 2828	2764	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	38
PID 2720 wrote to memory of 2572	2720	E936.tmp	39
PID 2720 wrote to memory of 2572	2720	E936.tmp	39
PID 2720 wrote to memory of 2572	2720	E936.tmp	39
PID 2720 wrote to memory of 2572	2720	E936.tmp	39
PID 2768 wrote to memory of 2756	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	41
PID 2768 wrote to memory of 2756	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	41
PID 2768 wrote to memory of 2756	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	41
PID 2768 wrote to memory of 2756	2768	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	41
PID 2668 wrote to memory of 2836	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	42
PID 2668 wrote to memory of 2836	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	42
PID 2668 wrote to memory of 2836	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	42
PID 2668 wrote to memory of 2836	2668	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	42
PID 2828 wrote to memory of 2880	2828	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	40
PID 2828 wrote to memory of 2880	2828	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	40
PID 2828 wrote to memory of 2880	2828	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	40
PID 2828 wrote to memory of 2880	2828	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	40
PID 2836 wrote to memory of 2744	2836	E957.tmp	43
PID 2836 wrote to memory of 2744	2836	E957.tmp	43
PID 2836 wrote to memory of 2744	2836	E957.tmp	43
PID 2836 wrote to memory of 2744	2836	E957.tmp	43
PID 2756 wrote to memory of 2288	2756	E956.tmp	44
PID 2756 wrote to memory of 2288	2756	E956.tmp	44
PID 2756 wrote to memory of 2288	2756	E956.tmp	44
PID 2756 wrote to memory of 2288	2756	E956.tmp	44
PID 2880 wrote to memory of 1688	2880	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	45
PID 2880 wrote to memory of 1688	2880	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	45
PID 2880 wrote to memory of 1688	2880	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	45
PID 2880 wrote to memory of 1688	2880	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	45
PID 1688 wrote to memory of 2732	1688	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2732	1688	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2732	1688	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2732	1688	6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe	46

C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        7⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        9⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        10⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        11⤵
        Loads dropped DLL
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        12⤵
        Loads dropped DLL
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        13⤵
        Loads dropped DLL
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        14⤵
        Loads dropped DLL
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        15⤵
        Loads dropped DLL
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        16⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        17⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        18⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        19⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        20⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        21⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        22⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        23⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        24⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        25⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        26⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        27⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        28⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        29⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        30⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        31⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        32⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        33⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        34⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        35⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        36⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        37⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        38⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        39⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        40⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        41⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        42⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        43⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        44⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        45⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        46⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        47⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        48⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        49⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        50⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        51⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        52⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        53⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        54⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        55⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        56⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        57⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        58⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        59⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        60⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        61⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        62⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        63⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        64⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        65⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        66⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        67⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        68⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        69⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        70⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        71⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        72⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        73⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        74⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        75⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        76⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        77⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        78⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        79⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        80⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        81⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        82⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        83⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        84⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        85⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        86⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        87⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        88⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        89⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        90⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        91⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        92⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        93⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        94⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        95⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        96⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        97⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        98⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        99⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        100⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        101⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        102⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        103⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        104⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        105⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        106⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        107⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        108⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        109⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        110⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        111⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        112⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        113⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        114⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        115⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        116⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        117⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        118⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        119⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        120⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        121⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        122⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        123⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        124⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        125⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        126⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        127⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        128⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        129⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        130⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        131⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        132⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        133⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        134⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        135⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        136⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        137⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        138⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        139⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        140⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        141⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        142⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        143⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        144⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        145⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        146⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        147⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        148⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        149⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        150⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        151⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        152⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        153⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        154⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        155⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        156⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        157⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        158⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        159⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        160⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        161⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        162⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        163⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        164⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        165⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        166⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        167⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        168⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        169⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        170⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        171⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        172⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        173⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        174⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        175⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        176⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        177⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        178⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        179⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        180⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        181⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        182⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        183⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        184⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        185⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        186⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        187⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        188⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        189⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        190⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        191⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        192⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        193⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        194⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        195⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        196⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        197⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        198⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        199⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        200⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        201⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        202⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        203⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        204⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        205⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        206⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        207⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        208⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        209⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        210⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        211⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        212⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        213⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        214⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        215⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        216⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        217⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        218⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        219⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        220⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        221⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        222⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        223⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        224⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        225⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        226⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        227⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        228⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        229⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        230⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        231⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        232⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        233⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        234⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        235⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        236⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        237⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        238⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        239⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        240⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        241⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        242⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        243⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        244⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        245⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        246⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        247⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        248⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        249⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        250⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        251⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        252⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        253⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        254⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        255⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        256⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        257⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        258⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        259⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        260⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        261⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        262⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        263⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        264⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        265⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        266⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        267⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        268⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        269⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        270⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        271⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        272⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        273⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        274⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        275⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        276⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        277⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        278⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        279⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        280⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        281⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        282⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        283⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        284⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        285⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        286⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        287⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        288⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        289⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        290⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        291⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        292⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        293⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        294⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        295⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        296⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        297⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        298⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        299⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        300⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        301⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        302⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        303⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        304⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        305⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        306⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        307⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        308⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        309⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        310⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        311⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        312⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        313⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        314⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        315⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        316⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        317⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        318⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        319⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        320⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        321⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        322⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        323⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        324⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        325⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        326⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        327⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        328⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        329⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        330⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        331⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        332⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        333⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        334⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        335⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        336⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        337⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        338⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        339⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        340⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        341⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        342⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6755770ced0f41a960bbcfe699ea40b0_JaffaCakes118.exe"
        343⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\39C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39C6.tmp"
        342⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\3978.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3978.tmp"
        341⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11092 -s 88
        342⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\392A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\392A.tmp"
        340⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11016 -s 88
        341⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\38DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38DC.tmp"
        339⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11072 -s 88
        340⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\387E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\387E.tmp"
        338⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10740 -s 88
        339⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\3830.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3830.tmp"
        337⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10660 -s 88
        338⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\37E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37E2.tmp"
        336⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10748 -s 88
        337⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\37A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37A4.tmp"
        335⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10428 -s 88
        336⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\3756.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3756.tmp"
        334⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10292 -s 88
        335⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\3708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3708.tmp"
        333⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10444 -s 88
        334⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\36BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36BA.tmp"
        332⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10320 -s 88
        333⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\366C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\366C.tmp"
        331⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11240 -s 88
        332⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\361E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\361E.tmp"
        330⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11200 -s 88
        331⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\35DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35DF.tmp"
        329⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11160 -s 88
        330⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\3582.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3582.tmp"
        328⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11116 -s 88
        329⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\3524.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3524.tmp"
        327⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11064 -s 88
        328⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\34D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34D6.tmp"
        326⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11024 -s 88
        327⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\3498.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3498.tmp"
        325⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10992 -s 88
        326⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\344A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\344A.tmp"
        324⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10944 -s 88
        325⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\33FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33FC.tmp"
        323⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10896 -s 88
        324⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\33AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33AE.tmp"
        322⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 88
        323⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\3360.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3360.tmp"
        321⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10808 -s 88
        322⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\3321.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3321.tmp"
        320⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10772 -s 88
        321⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\32E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32E3.tmp"
        319⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10732 -s 88
        320⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\3285.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3285.tmp"
        318⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10676 -s 88
        319⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\3237.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3237.tmp"
        317⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10636 -s 88
        318⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\31F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31F9.tmp"
        316⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10592 -s 88
        317⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\31AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31AB.tmp"
        315⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10536 -s 88
        316⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\316C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\316C.tmp"
        314⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10492 -s 88
        315⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\311E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\311E.tmp"
        313⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10448 -s 88
        314⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\30D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30D0.tmp"
        312⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10392 -s 88
        313⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\3092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3092.tmp"
        311⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10368 -s 88
        312⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\3044.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3044.tmp"
        310⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10312 -s 88
        311⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\2FE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"
        309⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10256 -s 88
        310⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\2F98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F98.tmp"
        308⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9580 -s 88
        309⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\2F4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"
        307⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10180 -s 88
        308⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\2F0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"
        306⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9028 -s 88
        307⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\2ECE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"
        305⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9688 -s 88
        306⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\2E8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"
        304⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10128 -s 88
        305⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\2E51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E51.tmp"
        303⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10208 -s 88
        304⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\2E12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E12.tmp"
        302⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9912 -s 88
        303⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\2DC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"
        301⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9772 -s 88
        302⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\2D86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D86.tmp"
        300⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 88
        301⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\2D57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D57.tmp"
        299⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9784 -s 88
        300⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\2D09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D09.tmp"
        298⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9436 -s 88
        299⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\2CBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"
        297⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9480 -s 88
        298⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\2C7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"
        296⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 88
        297⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\2C2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"
        295⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9244 -s 88
        296⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\2BE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"
        294⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10200 -s 88
        295⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\2B83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B83.tmp"
        293⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10148 -s 88
        294⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\2B35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B35.tmp"
        292⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10104 -s 88
        293⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\2AE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"
        291⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10068 -s 88
        292⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\2A99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A99.tmp"
        290⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10028 -s 88
        291⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\2A4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"
        289⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9984 -s 88
        290⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\2A0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"
        288⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9940 -s 88
        289⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\29CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29CE.tmp"
        287⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9892 -s 88
        288⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\2990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2990.tmp"
        286⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9840 -s 88
        287⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\2952.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2952.tmp"
        285⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9812 -s 88
        286⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\2913.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2913.tmp"
        284⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9776 -s 88
        285⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\28D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D5.tmp"
        283⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9716 -s 88
        284⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\28A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28A6.tmp"
        282⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9692 -s 88
        283⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\2858.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2858.tmp"
        281⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9636 -s 88
        282⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\281A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\281A.tmp"
        280⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9596 -s 88
        281⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\27DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27DB.tmp"
        279⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9556 -s 88
        280⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\279D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\279D.tmp"
        278⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9512 -s 88
        279⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\275E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\275E.tmp"
        277⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 88
        278⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\2701.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2701.tmp"
        276⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9404 -s 88
        277⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\26B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26B3.tmp"
        275⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9364 -s 88
        276⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\2655.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2655.tmp"
        274⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9324 -s 88
        275⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\2607.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2607.tmp"
        273⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9280 -s 88
        274⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\25B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25B9.tmp"
        272⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9228 -s 88
        273⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\256B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\256B.tmp"
        271⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 88
        272⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\252D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\252D.tmp"
        270⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9140 -s 88
        271⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\24FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24FE.tmp"
        269⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 88
        270⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\24C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24C0.tmp"
        268⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8588 -s 88
        269⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\2481.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2481.tmp"
        267⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8320 -s 88
        268⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\2443.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2443.tmp"
        266⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8948 -s 88
        267⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\23F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F5.tmp"
        265⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9000 -s 88
        266⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\23A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23A7.tmp"
        264⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8652 -s 88
        265⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\2368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2368.tmp"
        263⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 88
        264⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\232A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\232A.tmp"
        262⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 88
        263⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\22DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22DC.tmp"
        261⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8336 -s 88
        262⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\228E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\228E.tmp"
        260⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8368 -s 88
        261⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\2250.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2250.tmp"
        259⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 88
        260⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\2202.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2202.tmp"
        258⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9188 -s 88
        259⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\21C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21C3.tmp"
        257⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9156 -s 88
        258⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\2175.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2175.tmp"
        256⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9116 -s 88
        257⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\2127.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2127.tmp"
        255⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9064 -s 88
        256⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\20D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20D9.tmp"
        254⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9016 -s 88
        255⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\208B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\208B.tmp"
        253⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8960 -s 88
        254⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\204D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\204D.tmp"
        252⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8924 -s 88
        253⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\200E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\200E.tmp"
        251⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8892 -s 88
        252⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\1FC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"
        250⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8836 -s 88
        251⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\1F92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F92.tmp"
        249⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8808 -s 88
        250⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\1F53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F53.tmp"
        248⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 88
        249⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\1F15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F15.tmp"
        247⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 88
        248⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\1ED6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"
        246⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8684 -s 88
        247⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\1E98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E98.tmp"
        245⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8640 -s 88
        246⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\1E4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"
        244⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 88
        245⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\1DFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"
        243⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8536 -s 88
        244⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\1DAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"
        242⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8488 -s 88
        243⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\1D50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D50.tmp"
        241⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8432 -s 88
        242⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\1D02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D02.tmp"
        240⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8400 -s 88
        241⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\1CB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"
        239⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8352 -s 88
        240⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\1C66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C66.tmp"
        238⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8312 -s 88
        239⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\1C18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C18.tmp"
        237⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8268 -s 88
        238⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\1BDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"
        236⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8224 -s 88
        237⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\1B8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"
        235⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 88
        236⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\1B4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"
        234⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8088 -s 88
        235⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\1B00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B00.tmp"
        233⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 88
        234⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\1AC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"
        232⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 88
        233⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\1A83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A83.tmp"
        231⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 88
        232⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\1A44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A44.tmp"
        230⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8148 -s 88
        231⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\19F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19F6.tmp"
        229⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 88
        230⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\19A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19A8.tmp"
        228⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 88
        229⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\196A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\196A.tmp"
        227⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 88
        228⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\192C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\192C.tmp"
        226⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 88
        227⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\18FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18FD.tmp"
        225⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7368 -s 88
        226⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\18AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18AF.tmp"
        224⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 88
        225⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\1870.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1870.tmp"
        223⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 88
        224⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\1842.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1842.tmp"
        222⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 88
        223⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\1803.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1803.tmp"
        221⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8164 -s 88
        222⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\17B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17B5.tmp"
        220⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8120 -s 88
        221⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\1767.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1767.tmp"
        219⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8072 -s 88
        220⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\1729.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1729.tmp"
        218⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8020 -s 88
        219⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\16FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16FA.tmp"
        217⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7996 -s 88
        218⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\16BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16BC.tmp"
        216⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 88
        217⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\167D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\167D.tmp"
        215⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7908 -s 88
        216⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\164E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\164E.tmp"
        214⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 88
        215⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\1600.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1600.tmp"
        213⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 88
        214⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\15C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15C2.tmp"
        212⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 88
        213⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\1593.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1593.tmp"
        211⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 88
        212⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\1555.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1555.tmp"
        210⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7688 -s 88
        211⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\1516.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1516.tmp"
        209⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 88
        210⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\14D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14D8.tmp"
        208⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 88
        209⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\149A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\149A.tmp"
        207⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 88
        208⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\144C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\144C.tmp"
        206⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 88
        207⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\140D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\140D.tmp"
        205⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 88
        206⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\13CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13CF.tmp"
        204⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7400 -s 88
        205⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\13A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13A0.tmp"
        203⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7376 -s 88
        204⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\1362.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1362.tmp"
        202⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 88
        203⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\1323.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1323.tmp"
        201⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 88
        202⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\12E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12E5.tmp"
        200⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 88
        201⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\12B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12B6.tmp"
        199⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 88
        200⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\1287.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1287.tmp"
        198⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 88
        199⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\1249.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1249.tmp"
        197⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 88
        198⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\120A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\120A.tmp"
        196⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 88
        197⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\11DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11DC.tmp"
        195⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 88
        196⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\119D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\119D.tmp"
        194⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 88
        195⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\115F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\115F.tmp"
        193⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 88
        194⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\1111.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1111.tmp"
        192⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 88
        193⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\10D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10D2.tmp"
        191⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 88
        192⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\1094.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1094.tmp"
        190⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 88
        191⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\1046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1046.tmp"
        189⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 88
        190⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\1008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1008.tmp"
        188⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6436 -s 88
        189⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAA.tmp"
        187⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 88
        188⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\F6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6C.tmp"
        186⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 88
        187⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\F2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2D.tmp"
        185⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 88
        186⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\EEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEF.tmp"
        184⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 88
        185⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\EB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB0.tmp"
        183⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 88
        184⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\E62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E62.tmp"
        182⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 88
        183⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\E24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E24.tmp"
        181⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 88
        182⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\DD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD6.tmp"
        180⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 88
        181⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\D98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D98.tmp"
        179⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 88
        180⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\D4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4A.tmp"
        178⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 88
        179⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\D0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0B.tmp"
        177⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 88
        178⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\CCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCD.tmp"
        176⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 88
        177⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\C8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8E.tmp"
        175⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 88
        176⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\C50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C50.tmp"
        174⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 88
        175⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\C02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C02.tmp"
        173⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 88
        174⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\BB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB4.tmp"
        172⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 88
        173⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\B85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B85.tmp"
        171⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 88
        172⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\B47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B47.tmp"
        170⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 88
        171⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\B08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B08.tmp"
        169⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 88
        170⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\ABA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABA.tmp"
        168⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 88
        169⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\A8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8C.tmp"
        167⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 88
        168⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\A5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5D.tmp"
        166⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 88
        167⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1E.tmp"
        165⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 88
        166⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\9E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E0.tmp"
        164⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6224 -s 88
        165⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\992.tmp"
        163⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 88
        164⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\954.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\954.tmp"
        162⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 88
        163⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\925.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\925.tmp"
        161⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 88
        162⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\8F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F6.tmp"
        160⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 88
        161⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\8B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B8.tmp"
        159⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 88
        160⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\879.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\879.tmp"
        158⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 88
        159⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\82B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82B.tmp"
        157⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 88
        158⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\7FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FC.tmp"
        156⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 88
        157⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\7CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CE.tmp"
        155⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 88
        156⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\780.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\780.tmp"
        154⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 88
        155⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\741.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\741.tmp"
        153⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 88
        154⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\703.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\703.tmp"
        152⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 88
        153⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\6D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D4.tmp"
        151⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 88
        152⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\686.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\686.tmp"
        150⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 88
        151⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\638.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\638.tmp"
        149⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 88
        150⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\5FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FA.tmp"
        148⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 88
        149⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\5CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CB.tmp"
        147⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 88
        148⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\58C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58C.tmp"
        146⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 88
        147⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\53E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53E.tmp"
        145⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 88
        146⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\500.tmp"
        144⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 88
        145⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\4C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C2.tmp"
        143⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 88
        144⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\483.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\483.tmp"
        142⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 88
        143⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\464.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\464.tmp"
        141⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 88
        142⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\416.tmp"
        140⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 88
        141⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\3D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D8.tmp"
        139⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 88
        140⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\3A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A9.tmp"
        138⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 88
        139⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\36A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36A.tmp"
        137⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 88
        138⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\31C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31C.tmp"
        136⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 88
        137⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\2DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DE.tmp"
        135⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 88
        136⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\2AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF.tmp"
        134⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 88
        135⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\280.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\280.tmp"
        133⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 88
        134⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\232.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\232.tmp"
        132⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 88
        133⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\1E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E4.tmp"
        131⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 88
        132⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\1B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B6.tmp"
        130⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 88
        131⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\168.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\168.tmp"
        129⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 88
        130⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\139.tmp"
        128⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 88
        129⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA.tmp"
        127⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 88
        128⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC.tmp"
        126⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 88
        127⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E.tmp"
        125⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 88
        126⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\3F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F.tmp"
        124⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 88
        125⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1.tmp"
        123⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 88
        124⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\FFC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFC2.tmp"
        122⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 88
        123⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\FF84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF84.tmp"
        121⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 88
        122⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\FF46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF46.tmp"
        120⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 88
        121⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\FF07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF07.tmp"
        119⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 88
        120⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\FEC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"
        118⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 88
        119⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\FE9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"
        117⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 88
        118⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\FE5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"
        116⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 88
        117⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\FE1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"
        115⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 88
        116⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\FDCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"
        114⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 88
        115⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\FD91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD91.tmp"
        113⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 88
        114⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\FD43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD43.tmp"
        112⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 88
        113⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\FCE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"
        111⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 88
        112⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\FC97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC97.tmp"
        110⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 88
        111⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\FC49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC49.tmp"
        109⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 88
        110⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\FC2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"
        108⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 88
        109⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\FBEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"
        107⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 88
        108⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\FBAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"
        106⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 88
        107⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\FB7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"
        105⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 88
        106⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\FB40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB40.tmp"
        104⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 88
        105⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\FB11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB11.tmp"
        103⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 88
        104⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\FAD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"
        102⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 88
        103⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\FAA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"
        101⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 88
        102⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\FA75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA75.tmp"
        100⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 88
        101⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\FA37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA37.tmp"
        99⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 88
        100⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\FA08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA08.tmp"
        98⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 88
        99⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\F9CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"
        97⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 88
        98⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\F97C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F97C.tmp"
        96⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 88
        97⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\F94D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F94D.tmp"
        95⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 88
        96⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\F91E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F91E.tmp"
        94⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 88
        95⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\F8E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"
        93⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 88
        94⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\F8B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"
        92⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 88
        93⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\F882.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F882.tmp"
        91⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 88
        92⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\F844.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F844.tmp"
        90⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 88
        91⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\F815.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F815.tmp"
        89⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 88
        90⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\F7E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"
        88⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 88
        89⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\F7A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"
        87⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 88
        88⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\F779.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F779.tmp"
        86⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 88
        87⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\F74A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F74A.tmp"
        85⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 88
        86⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\F70C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F70C.tmp"
        84⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 88
        85⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\F6DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"
        83⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 88
        84⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\F6AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"
        82⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 88
        83⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\F67F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F67F.tmp"
        81⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 88
        82⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\F641.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F641.tmp"
        80⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 88
        81⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\F602.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F602.tmp"
        79⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 88
        80⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\F5B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"
        78⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 88
        79⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\F576.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F576.tmp"
        77⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 88
        78⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\F538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F538.tmp"
        76⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 88
        77⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\F4F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"
        75⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 88
        76⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\F4CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"
        74⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 88
        75⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\F49C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F49C.tmp"
        73⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 88
        74⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\F44E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F44E.tmp"
        72⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 88
        73⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\F41F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F41F.tmp"
        71⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 88
        72⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\F3F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"
        70⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 88
        71⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\F3B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"
        69⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 88
        70⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\F373.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F373.tmp"
        68⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 88
        69⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\F344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F344.tmp"
        67⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 88
        68⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\F306.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F306.tmp"
        66⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 88
        67⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\F2D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"
        65⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 88
        66⤵
        Program crash
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\F299.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F299.tmp"
        64⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 88
        65⤵
        Program crash
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\F26A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F26A.tmp"
        63⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 88
        64⤵
        Program crash
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\F21C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F21C.tmp"
        62⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 88
        63⤵
        Program crash
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\F1ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"
        61⤵
        Executes dropped EXE
        
        PID:3436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 88
        62⤵
        Program crash
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\F1BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"
        60⤵
        Executes dropped EXE
        
        PID:3404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 88
        61⤵
        Program crash
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\F190.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F190.tmp"
        59⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 88
        60⤵
        Program crash
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\F161.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F161.tmp"
        58⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 88
        59⤵
        Program crash
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\F142.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F142.tmp"
        57⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 88
        58⤵
        Program crash
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\F113.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F113.tmp"
        56⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 88
        57⤵
        Program crash
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\F0E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"
        55⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 88
        56⤵
        Program crash
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\F0C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"
        54⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 88
        55⤵
        Program crash
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\F096.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F096.tmp"
        53⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 88
        54⤵
        Program crash
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\F067.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F067.tmp"
        52⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 88
        53⤵
        Program crash
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\F048.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F048.tmp"
        51⤵
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 88
        52⤵
        Program crash
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\F019.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F019.tmp"
        50⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 88
        51⤵
        Program crash
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\EFEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"
        49⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 88
        50⤵
        Program crash
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\EFCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"
        48⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 88
        49⤵
        Program crash
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\EF9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"
        47⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 88
        48⤵
        Program crash
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\EF6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"
        46⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 88
        47⤵
        Program crash
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\EF4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"
        45⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 88
        46⤵
        Program crash
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\EF20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF20.tmp"
        44⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 88
        45⤵
        Program crash
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\EEF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"
        43⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 88
        44⤵
        Program crash
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\EEC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"
        42⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 88
        43⤵
        Program crash
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\EE93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE93.tmp"
        41⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 88
        42⤵
        Program crash
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\EE74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE74.tmp"
        40⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 88
        41⤵
        Program crash
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\EE45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE45.tmp"
        39⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 88
        40⤵
        Program crash
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\EE16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE16.tmp"
        38⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 88
        39⤵
        Program crash
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\EDE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"
        37⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 88
        38⤵
        Program crash
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\EDC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"
        36⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 88
        37⤵
        Program crash
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\ED9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"
        35⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 88
        36⤵
        Program crash
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\ED7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"
        34⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 88
        35⤵
        Program crash
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\ED4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"
        33⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 88
        34⤵
        Program crash
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\ED0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"
        32⤵
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 88
        33⤵
        Program crash
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\ECDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"
        31⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 88
        32⤵
        Program crash
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\ECBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"
        30⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 88
        31⤵
        Program crash
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\EC81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC81.tmp"
        29⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 88
        30⤵
        Program crash
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\EC52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC52.tmp"
        28⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 88
        29⤵
        Program crash
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\EC33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC33.tmp"
        27⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 88
        28⤵
        Program crash
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\EC23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC23.tmp"
        26⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 88
        27⤵
        Program crash
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\EBE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"
        25⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 88
        26⤵
        Program crash
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\EBD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBD6.tmp"
        24⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 88
        25⤵
        Program crash
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\EBD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"
        23⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 88
        24⤵
        Program crash
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\EB78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB78.tmp"
        22⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 88
        23⤵
        Program crash
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\EB69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB69.tmp"
        21⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 88
        22⤵
        Program crash
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\EB68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB68.tmp"
        20⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 88
        21⤵
        Program crash
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\EB49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB49.tmp"
        19⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 88
        20⤵
        Program crash
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\EB1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"
        18⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 88
        19⤵
        Program crash
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\EB0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"
        17⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 88
        18⤵
        Program crash
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\EAAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"
        16⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 88
        17⤵
        Program crash
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\EABC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EABC.tmp"
        15⤵
        Executes dropped EXE
        
        PID:3036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 88
        16⤵
        Program crash
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\EABD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EABD.tmp"
        14⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 88
        15⤵
        Program crash
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\EA20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA20.tmp"
        13⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 88
        14⤵
        Loads dropped DLL
        Program crash
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\EA11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA11.tmp"
        12⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 88
        13⤵
        Loads dropped DLL
        Program crash
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\EA21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA21.tmp"
        11⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 88
        12⤵
        Loads dropped DLL
        Program crash
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\E9E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"
        10⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 88
        11⤵
        Loads dropped DLL
        Program crash
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\E9D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"
        9⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 88
        10⤵
        Loads dropped DLL
        Program crash
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\E9C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"
        8⤵
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 88
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\E9B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"
        7⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 88
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\E994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E994.tmp"
        6⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 88
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\E984.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E984.tmp"
        5⤵
        Executes dropped EXE
        
        PID:2576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 88
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\E956.tmp
      "C:\Users\Admin\AppData\Local\Temp\E956.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 88
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2288
- - C:\Users\Admin\AppData\Local\Temp\E957.tmp
    "C:\Users\Admin\AppData\Local\Temp\E957.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 88
      4⤵
      Loads dropped DLL
      Program crash
      PID:2744
- C:\Users\Admin\AppData\Local\Temp\E936.tmp
  "C:\Users\Admin\AppData\Local\Temp\E936.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 88
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E936.tmp

Filesize
144KB

MD5
c5ad1457dba612bbd7751aa5354075b1

SHA1
0641d7a09a843a8b362bd290edfc49a5bd84e370

SHA256
9bbe2e7a01cd564a82a8e89ae254bb98c063cdd524370254acd05e296410cfaa

SHA512
5c50bafd795bad8b4a234eeeb53499caab0489f9c4ef072f255bc5e0e03f1c277884c8488858f3b7206d1609d7bbd1dfd33366f67e3aecffa8153cdd43d86cb4

Download Submit
memory/2720-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads