734627088382cd5c524be577afa06bd8a1b077a83a144b1323ef609b483982e7

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Size

856KB
MD5

a1849707367f80b29da945ce3cf58020
SHA1

b21cb04dc09d28222e2ed80f940610a443d7a830
SHA256

734627088382cd5c524be577afa06bd8a1b077a83a144b1323ef609b483982e7
SHA512

0742b133bc3f51544ac98d42c990c25433fae436a79092ba40d82060f8328ef210daebe36c94a1b3e741b09874042130fbcd975fbfd9afe77f343c48703d1813
SSDEEP

24576:OKnYI/jQMVQCccK1EShWstH3+klJQmSvNDQMyta:OKnYkjQAQCccGd3FuklSZNErM

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2792 set thread context of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2872 set thread context of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 680 set thread context of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 1104 set thread context of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 2480 set thread context of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2756 set thread context of 2716	2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	36
PID 2716 set thread context of 3020	2716	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	37
PID 3020 set thread context of 852	3020	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	38
PID 852 set thread context of 2588	852	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	39
PID 2588 set thread context of 2436	2588	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	40
PID 2436 set thread context of 596	2436	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	41
PID 596 set thread context of 652	596	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	42
PID 652 set thread context of 1752	652	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	43
PID 1752 set thread context of 1052	1752	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	44
PID 1052 set thread context of 2780	1052	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	45
PID 2780 set thread context of 2076	2780	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	46
PID 2076 set thread context of 1768	2076	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	47
PID 1768 set thread context of 1056	1768	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	48
PID 1056 set thread context of 748	1056	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	49
PID 748 set thread context of 2052	748	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	50
PID 2052 set thread context of 2960	2052	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	51
PID 2960 set thread context of 2796	2960	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	52
PID 2796 set thread context of 2120	2796	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	53
PID 2120 set thread context of 1876	2120	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	54
PID 1876 set thread context of 2640	1876	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	55
PID 2640 set thread context of 2896	2640	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	56
PID 2896 set thread context of 2256	2896	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	57
PID 2256 set thread context of 1748	2256	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	58
PID 1748 set thread context of 2808	1748	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	59
PID 2808 set thread context of 2680	2808	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	60
PID 2680 set thread context of 2192	2680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	61
PID 2192 set thread context of 2312	2192	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	62
PID 2312 set thread context of 876	2312	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	63
PID 876 set thread context of 2556	876	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	64
PID 2556 set thread context of 2956	2556	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	65
PID 2956 set thread context of 2388	2956	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	66
PID 2388 set thread context of 1436	2388	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	67
PID 1436 set thread context of 1996	1436	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	68
PID 1996 set thread context of 2264	1996	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	69
PID 2264 set thread context of 2548	2264	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	70
PID 2548 set thread context of 1144	2548	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	71
PID 1144 set thread context of 2004	1144	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	72
PID 2004 set thread context of 1504	2004	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	73
PID 1504 set thread context of 2620	1504	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	74
PID 2620 set thread context of 3056	2620	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	75
PID 3056 set thread context of 2152	3056	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	76
PID 2152 set thread context of 2088	2152	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	77
PID 2088 set thread context of 2180	2088	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	78
PID 2180 set thread context of 2692	2180	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	79
PID 2692 set thread context of 2364	2692	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	80
PID 2364 set thread context of 2472	2364	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	81
PID 2472 set thread context of 1068	2472	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	82
PID 1068 set thread context of 2736	1068	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	83
PID 2736 set thread context of 1740	2736	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	84
PID 1740 set thread context of 756	1740	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	85
PID 756 set thread context of 1592	756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	86
PID 1592 set thread context of 1936	1592	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	87
PID 1936 set thread context of 2232	1936	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	88
PID 2232 set thread context of 2428	2232	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	89
PID 2428 set thread context of 1108	2428	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	90
PID 1108 set thread context of 2156	1108	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	91
PID 2156 set thread context of 536	2156	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	92
PID 536 set thread context of 3040	536	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	94

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2716	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2716	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
3020	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
3020	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
852	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
852	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2588	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2588	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2436	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2436	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
596	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
596	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
652	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
652	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1752	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1752	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1052	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1052	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2780	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2780	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2076	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2076	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1768	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1768	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1056	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1056	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
748	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
748	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2052	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2052	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2960	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2960	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2796	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2796	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2120	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2120	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1876	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1876	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2640	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2640	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2896	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2896	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2256	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2256	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1748	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
1748	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2808	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2808	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
2680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2792	2280	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2872	2792	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	31
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 2872 wrote to memory of 680	2872	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	32
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 680 wrote to memory of 1104	680	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	33
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 1104 wrote to memory of 2480	1104	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	34
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2756	2480	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	35
PID 2756 wrote to memory of 2716	2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	36
PID 2756 wrote to memory of 2716	2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	36
PID 2756 wrote to memory of 2716	2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	36
PID 2756 wrote to memory of 2716	2756	a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        8⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        9⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        10⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        11⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        12⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        13⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        14⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        15⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        16⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        17⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        18⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        19⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        20⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        21⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        22⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        23⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        24⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        25⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        26⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        27⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        28⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        29⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        30⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        31⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        32⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        33⤵
        Suspicious use of SetThreadContext
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        34⤵
        Suspicious use of SetThreadContext
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        35⤵
        Suspicious use of SetThreadContext
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        36⤵
        Suspicious use of SetThreadContext
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        37⤵
        Suspicious use of SetThreadContext
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        38⤵
        Suspicious use of SetThreadContext
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        39⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        40⤵
        Suspicious use of SetThreadContext
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        41⤵
        Suspicious use of SetThreadContext
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        42⤵
        Suspicious use of SetThreadContext
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        43⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        44⤵
        Suspicious use of SetThreadContext
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        45⤵
        Suspicious use of SetThreadContext
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        46⤵
        Suspicious use of SetThreadContext
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        47⤵
        Suspicious use of SetThreadContext
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        48⤵
        Suspicious use of SetThreadContext
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        49⤵
        Suspicious use of SetThreadContext
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        50⤵
        Suspicious use of SetThreadContext
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        51⤵
        Suspicious use of SetThreadContext
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        52⤵
        Suspicious use of SetThreadContext
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        53⤵
        Suspicious use of SetThreadContext
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        54⤵
        Suspicious use of SetThreadContext
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        55⤵
        Suspicious use of SetThreadContext
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        56⤵
        Suspicious use of SetThreadContext
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        57⤵
        Suspicious use of SetThreadContext
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        58⤵
        Suspicious use of SetThreadContext
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        59⤵
        Suspicious use of SetThreadContext
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        60⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        61⤵
        Suspicious use of SetThreadContext
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        62⤵
        Suspicious use of SetThreadContext
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        63⤵
        Suspicious use of SetThreadContext
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        64⤵
        Suspicious use of SetThreadContext
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        65⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        66⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        67⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        68⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        70⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        71⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        72⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        73⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        74⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        75⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        76⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        77⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        79⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        80⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        82⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        84⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        85⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        86⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        87⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        88⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        89⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        90⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        91⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        92⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        93⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        94⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        95⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        96⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        97⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        98⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        99⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        100⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        101⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        102⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        103⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        104⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        105⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        106⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        107⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        108⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        109⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        110⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        111⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        112⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        113⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        114⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        115⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        116⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        117⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        118⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        119⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        120⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        122⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        123⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        124⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        125⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        126⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        127⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        128⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        129⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        130⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        131⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        132⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        134⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        135⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        136⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        137⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        138⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        139⤵
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        140⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        141⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        142⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        144⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        145⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        146⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        147⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        148⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        149⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        150⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        151⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        152⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        153⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        154⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        155⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        156⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        157⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        158⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        159⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        161⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        162⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        163⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        164⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        165⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        166⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        167⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        168⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        170⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        171⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        172⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        173⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        174⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        175⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        176⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        177⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        178⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        180⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        181⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        183⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        184⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        185⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        186⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        187⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        188⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        189⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        191⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        192⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        193⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        195⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        198⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        199⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        200⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        201⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        202⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        203⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        204⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        205⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        206⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        207⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        208⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        209⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        211⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        212⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        213⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        214⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        217⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        218⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        219⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        220⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        221⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        222⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        223⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        224⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        225⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        226⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        227⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        228⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        229⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        230⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        232⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        233⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        234⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        235⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        236⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        238⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        239⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        241⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        242⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        243⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        244⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        245⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        246⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        248⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        249⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        250⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        251⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        252⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        254⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        255⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        256⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        257⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        259⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        260⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        261⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        262⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        264⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        265⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        266⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        267⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        268⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        270⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        271⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        272⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        273⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        275⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        277⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        278⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        279⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        280⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        281⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        282⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        283⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        284⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        285⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        286⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        287⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        289⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        291⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        292⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        293⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        294⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        295⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        296⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        297⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        299⤵
        System Location Discovery: System Language Discovery
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        300⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        301⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        303⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        305⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        306⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        307⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        308⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        309⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        310⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        311⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        312⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        313⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        314⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        315⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        316⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        317⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        318⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        319⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        321⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        322⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        323⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        325⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        326⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        327⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        328⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        329⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        330⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        332⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        333⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        335⤵
        
        PID:496
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        336⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        337⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        338⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        339⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        340⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        341⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        342⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        343⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        344⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        345⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        346⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        347⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        350⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        351⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        352⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        353⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        354⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        355⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        356⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        357⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        358⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        359⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        361⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        362⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        364⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        365⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        366⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        367⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        368⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        369⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        370⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        371⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        372⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        373⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        374⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        375⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        376⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        377⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        378⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        379⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        380⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        381⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        383⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        384⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        386⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        387⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        388⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        389⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        390⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        391⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        392⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        393⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        394⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        395⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        396⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        397⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        398⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        399⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        400⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        402⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        403⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        404⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        406⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        407⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        408⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        409⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        410⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        411⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        412⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        413⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        414⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        415⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        416⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        417⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        418⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        419⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        420⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        421⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        422⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        423⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        424⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        425⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        426⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        427⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        428⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        430⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        432⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        433⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        434⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        435⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        436⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        437⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        438⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        439⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        440⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        441⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        443⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        444⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        445⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        446⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        447⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        448⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        449⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        450⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        451⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        452⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        453⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        454⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        455⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        456⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        459⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        460⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        461⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        462⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        463⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        464⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        465⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        466⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        468⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        469⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        470⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\a1849707367f80b29da945ce3cf58020_JaffaCakes118.exe
        
        471⤵
        
        PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/348-10103-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/536-4604-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/596-945-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/652-946-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/680-296-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/784-10465-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/852-729-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/852-657-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/876-2530-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/876-2515-0x0000000002880000-0x000000000288C000-memory.dmp

Filesize
48KB

Download
memory/1052-1161-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1068-3888-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1104-368-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1108-4462-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1144-3102-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1216-6179-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1300-5892-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1312-5606-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1368-7178-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1384-7893-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1400-7749-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1452-9181-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1592-4173-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1620-5963-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1628-6250-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1744-9024-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/1748-2168-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1752-1089-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1768-1377-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1780-10388-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/1780-10393-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1804-6035-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1864-5249-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1876-1880-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1876-1809-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1932-7677-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1936-4245-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-4815-0x00000000027B0000-0x00000000027BC000-memory.dmp

Filesize
48KB

Download
memory/1944-4820-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1952-10537-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1996-2888-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2004-3174-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2036-7463-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2052-1591-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2076-1305-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2100-8894-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2112-7821-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2120-1807-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2120-1792-0x00000000027B0000-0x00000000027BC000-memory.dmp

Filesize
48KB

Download
memory/2148-8966-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-2384-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2192-2312-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2232-4317-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2256-2096-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2280-2-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2280-12-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2280-5-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2280-9-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2280-8-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/2280-11-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2280-10-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2280-73-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2280-7-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/2280-53-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/2280-52-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/2280-37-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/2280-36-0x0000000002470000-0x0000000002480000-memory.dmp

Filesize
64KB

Download
memory/2280-6-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/2280-51-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/2280-4-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2280-3-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2280-35-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/2280-34-0x0000000002450000-0x0000000002460000-memory.dmp

Filesize
64KB

Download
memory/2280-50-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/2280-19-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/2280-33-0x0000000002440000-0x0000000002450000-memory.dmp

Filesize
64KB

Download
memory/2280-32-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/2280-31-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/2280-30-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/2280-1-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2280-49-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/2280-29-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/2280-48-0x0000000002760000-0x0000000002770000-memory.dmp

Filesize
64KB

Download
memory/2280-54-0x00000000027D0000-0x00000000027E0000-memory.dmp

Filesize
64KB

Download
memory/2280-47-0x0000000002560000-0x0000000002570000-memory.dmp

Filesize
64KB

Download
memory/2280-46-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/2280-28-0x00000000023F0000-0x0000000002400000-memory.dmp

Filesize
64KB

Download
memory/2280-27-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/2280-13-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/2280-14-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2280-45-0x0000000002540000-0x0000000002550000-memory.dmp

Filesize
64KB

Download
memory/2280-26-0x00000000023D0000-0x00000000023E0000-memory.dmp

Filesize
64KB

Download
memory/2280-15-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2280-44-0x0000000002530000-0x0000000002540000-memory.dmp

Filesize
64KB

Download
memory/2280-43-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2280-38-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/2280-16-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2280-25-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2280-24-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2280-39-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/2280-17-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2280-42-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/2280-23-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/2280-41-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/2280-40-0x00000000024F0000-0x0000000002500000-memory.dmp

Filesize
64KB

Download
memory/2280-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2280-18-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/2280-22-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2280-21-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2280-20-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2308-5463-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2312-2442-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/2312-2457-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2320-8536-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2320-8879-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/2364-3744-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2388-2745-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2408-10021-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/2420-8322-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2428-4389-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2436-873-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2464-8750-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2472-3816-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2480-440-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2576-6322-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2588-801-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2604-6736-0x00000000026E0000-0x00000000026EC000-memory.dmp

Filesize
48KB

Download
memory/2640-1952-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2696-6678-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2716-584-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2728-4748-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2756-512-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2772-6964-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2780-1233-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-147-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-71-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-74-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2808-2226-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/2816-9452-0x00000000027E0000-0x00000000027EC000-memory.dmp

Filesize
48KB

Download
memory/2852-8037-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2852-8022-0x0000000002790000-0x000000000279C000-memory.dmp

Filesize
48KB

Download
memory/2872-149-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2872-222-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2896-2024-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2952-4959-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/2952-4964-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2956-2673-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2960-1663-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3020-656-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3056-3388-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download