a2733058c309d3bb4bc3239b6d0feaf35b4d9f59cd52a0e09b6e54256d0fd4a0

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
Size

114KB
MD5

c7571f28c85bc57b873482d6b89f0d70
SHA1

7552d7bedbde80baf885ddb1a5bee3ca57c71eb1
SHA256

a2733058c309d3bb4bc3239b6d0feaf35b4d9f59cd52a0e09b6e54256d0fd4a0
SHA512

d3418f0a92294d280b2cce7c4080d540051e2a29bd04bbef822f2af8d455b795f0b4a123a652611948a896405856f7f603e6d965b948ab272bdc7e8c2ece8a62
SSDEEP

1536:iWCXkOn85Tx8oOyffa5h7H/2cdf09g8HJMhyH83Uh0E1sLSyygdGMGKeN2zdQ:iWCA52oOt7hdfwXwUh0ByIbx

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 3604	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	85
PID 1980 set thread context of 2388	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	86
PID 1980 set thread context of 3624	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	87
PID 1980 set thread context of 3176	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	95
PID 1980 set thread context of 2528	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	96
PID 1980 set thread context of 4804	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	97
PID 1980 set thread context of 620	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	104
PID 1980 set thread context of 4708	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	105
PID 1980 set thread context of 396	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	106
PID 1980 set thread context of 1284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	113
PID 1980 set thread context of 1492	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	114
PID 1980 set thread context of 3392	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	115
PID 1980 set thread context of 4344	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	122
PID 1980 set thread context of 4768	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	123
PID 1980 set thread context of 1120	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	124
PID 1980 set thread context of 5028	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	131
PID 1980 set thread context of 1308	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	132
PID 1980 set thread context of 1912	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	133
PID 1980 set thread context of 4824	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	140
PID 1980 set thread context of 2560	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	141
PID 1980 set thread context of 4528	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	142
PID 1980 set thread context of 2636	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	149
PID 1980 set thread context of 2856	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	150
PID 1980 set thread context of 2352	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	151
PID 1980 set thread context of 2872	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	158
PID 1980 set thread context of 3664	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	159
PID 1980 set thread context of 3060	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	160
PID 1980 set thread context of 4784	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	167
PID 1980 set thread context of 220	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	168
PID 1980 set thread context of 972	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	169
PID 1980 set thread context of 1572	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	176
PID 1980 set thread context of 2292	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	177
PID 1980 set thread context of 4188	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	178
PID 1980 set thread context of 3268	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	185
PID 1980 set thread context of 2808	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	186
PID 1980 set thread context of 1704	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	187
PID 1980 set thread context of 1960	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	194
PID 1980 set thread context of 3600	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	195
PID 1980 set thread context of 3432	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	196
PID 1980 set thread context of 3672	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	203
PID 1980 set thread context of 1756	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	204
PID 1980 set thread context of 2044	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	205
PID 1980 set thread context of 756	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	212
PID 1980 set thread context of 4404	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	213
PID 1980 set thread context of 4752	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	214
PID 1980 set thread context of 452	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	221
PID 1980 set thread context of 2284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	222
PID 1980 set thread context of 2300	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	223
PID 1980 set thread context of 2288	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	230
PID 1980 set thread context of 2828	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	231
PID 1980 set thread context of 4696	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	236
PID 1980 set thread context of 3496	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	237
PID 1980 set thread context of 3224	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	238
PID 1980 set thread context of 4284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	245
PID 1980 set thread context of 2940	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	246
PID 1980 set thread context of 3924	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	251
PID 1980 set thread context of 3468	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	252
PID 1980 set thread context of 692	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	253
PID 1980 set thread context of 2240	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	262
PID 1980 set thread context of 1120	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	263
PID 1980 set thread context of 1820	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	264
PID 1980 set thread context of 3568	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	271
PID 1980 set thread context of 1912	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	272
PID 1980 set thread context of 1688	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	273

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2772	3604	WerFault.exe	85
3228	2388	WerFault.exe	86
1904	3624	WerFault.exe	87
4928	3176	WerFault.exe	95
3872	2528	WerFault.exe	96
3224	4804	WerFault.exe	97
2476	620	WerFault.exe	104
3920	4708	WerFault.exe	105
4512	396	WerFault.exe	106
4368	1284	WerFault.exe	113
64	1492	WerFault.exe	114
1672	3392	WerFault.exe	115
3428	4344	WerFault.exe	122
720	4768	WerFault.exe	123
2112	1120	WerFault.exe	124
2248	5028	WerFault.exe	131
2384	1308	WerFault.exe	132
3020	1912	WerFault.exe	133
1968	4824	WerFault.exe	140
2912	2560	WerFault.exe	141
3708	4528	WerFault.exe	142
1264	2636	WerFault.exe	149
3692	2856	WerFault.exe	150
2592	2352	WerFault.exe	151
1748	2872	WerFault.exe	158
4856	3060	WerFault.exe	160
208	3664	WerFault.exe	159
4948	4784	WerFault.exe	167
2724	220	WerFault.exe	168
3524	972	WerFault.exe	169
4744	1572	WerFault.exe	176
1344	2292	WerFault.exe	177
4936	4188	WerFault.exe	178
2360	3268	WerFault.exe	185
4400	2808	WerFault.exe	186
664	1704	WerFault.exe	187
1160	1960	WerFault.exe	194
3572	3600	WerFault.exe	195
4628	3432	WerFault.exe	196
4852	3672	WerFault.exe	203
3340	1756	WerFault.exe	204
2392	2044	WerFault.exe	205
1192	756	WerFault.exe	212
2688	4752	WerFault.exe	214
4572	4404	WerFault.exe	213
4152	452	WerFault.exe	221
2840	2284	WerFault.exe	222
4560	2300	WerFault.exe	223
2108	2288	WerFault.exe	230
3704	2828	WerFault.exe	231
3320	4696	WerFault.exe	236
220	3496	WerFault.exe	237
4988	3224	WerFault.exe	238
1908	4284	WerFault.exe	245
3860	2940	WerFault.exe	246
100	3924	WerFault.exe	251
4072	3468	WerFault.exe	252
4328	692	WerFault.exe	253
3572	2240	WerFault.exe	262
4768	1120	WerFault.exe	263
2896	1820	WerFault.exe	264
4280	3568	WerFault.exe	271
4640	1912	WerFault.exe	272
224	1688	WerFault.exe	273

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3604	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	85
PID 1980 wrote to memory of 3604	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	85
PID 1980 wrote to memory of 3604	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	85
PID 1980 wrote to memory of 3604	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	85
PID 1980 wrote to memory of 2388	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	86
PID 1980 wrote to memory of 2388	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	86
PID 1980 wrote to memory of 2388	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	86
PID 1980 wrote to memory of 2388	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	86
PID 1980 wrote to memory of 3624	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	87
PID 1980 wrote to memory of 3624	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	87
PID 1980 wrote to memory of 3624	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	87
PID 1980 wrote to memory of 3624	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	87
PID 1980 wrote to memory of 3176	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	95
PID 1980 wrote to memory of 3176	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	95
PID 1980 wrote to memory of 3176	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	95
PID 1980 wrote to memory of 3176	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	95
PID 1980 wrote to memory of 2528	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	96
PID 1980 wrote to memory of 2528	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	96
PID 1980 wrote to memory of 2528	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	96
PID 1980 wrote to memory of 2528	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	96
PID 1980 wrote to memory of 4804	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	97
PID 1980 wrote to memory of 4804	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	97
PID 1980 wrote to memory of 4804	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	97
PID 1980 wrote to memory of 4804	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	97
PID 1980 wrote to memory of 620	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	104
PID 1980 wrote to memory of 620	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	104
PID 1980 wrote to memory of 620	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	104
PID 1980 wrote to memory of 620	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	104
PID 1980 wrote to memory of 4708	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	105
PID 1980 wrote to memory of 4708	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	105
PID 1980 wrote to memory of 4708	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	105
PID 1980 wrote to memory of 4708	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	105
PID 1980 wrote to memory of 396	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	106
PID 1980 wrote to memory of 396	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	106
PID 1980 wrote to memory of 396	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	106
PID 1980 wrote to memory of 396	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	106
PID 1980 wrote to memory of 1284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	113
PID 1980 wrote to memory of 1284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	113
PID 1980 wrote to memory of 1284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	113
PID 1980 wrote to memory of 1284	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	113
PID 1980 wrote to memory of 1492	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	114
PID 1980 wrote to memory of 1492	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	114
PID 1980 wrote to memory of 1492	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	114
PID 1980 wrote to memory of 1492	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	114
PID 1980 wrote to memory of 3392	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	115
PID 1980 wrote to memory of 3392	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	115
PID 1980 wrote to memory of 3392	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	115
PID 1980 wrote to memory of 3392	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	115
PID 1980 wrote to memory of 4344	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	122
PID 1980 wrote to memory of 4344	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	122
PID 1980 wrote to memory of 4344	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	122
PID 1980 wrote to memory of 4344	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	122
PID 1980 wrote to memory of 4768	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	123
PID 1980 wrote to memory of 4768	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	123
PID 1980 wrote to memory of 4768	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	123
PID 1980 wrote to memory of 4768	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	123
PID 1980 wrote to memory of 1120	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	124
PID 1980 wrote to memory of 1120	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	124
PID 1980 wrote to memory of 1120	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	124
PID 1980 wrote to memory of 1120	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	124
PID 1980 wrote to memory of 5028	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	131
PID 1980 wrote to memory of 5028	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	131
PID 1980 wrote to memory of 5028	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	131
PID 1980 wrote to memory of 5028	1980	c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe	131

C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 324
    3⤵
    - Program crash
    PID:2772
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 308
    3⤵
    - Program crash
    PID:3228
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 308
    3⤵
    - Program crash
    PID:1904
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 308
    3⤵
    - Program crash
    PID:4928
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 308
    3⤵
    - Program crash
    PID:3872
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 308
    3⤵
    - Program crash
    PID:3224
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 308
    3⤵
    - Program crash
    PID:2476
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 308
    3⤵
    - Program crash
    PID:3920
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 308
    3⤵
    - Program crash
    PID:4512
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 308
    3⤵
    - Program crash
    PID:4368
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 316
    3⤵
    - Program crash
    PID:64
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 308
    3⤵
    - Program crash
    PID:1672
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 316
    3⤵
    - Program crash
    PID:3428
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 308
    3⤵
    - Program crash
    PID:720
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 316
    3⤵
    - Program crash
    PID:2112
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 308
    3⤵
    - Program crash
    PID:2248
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 308
    3⤵
    - Program crash
    PID:2384
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 308
    3⤵
    - Program crash
    PID:3020
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 308
    3⤵
    - Program crash
    PID:1968
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 308
    3⤵
    - Program crash
    PID:2912
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 308
    3⤵
    - Program crash
    PID:3708
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 308
    3⤵
    - Program crash
    PID:1264
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 308
    3⤵
    - Program crash
    PID:3692
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 308
    3⤵
    - Program crash
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 308
    3⤵
    - Program crash
    PID:1748
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 308
    3⤵
    - Program crash
    PID:208
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 308
    3⤵
    - Program crash
    PID:4856
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 308
    3⤵
    - Program crash
    PID:4948
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 308
    3⤵
    - Program crash
    PID:2724
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 308
    3⤵
    - Program crash
    PID:3524
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 308
    3⤵
    - Program crash
    PID:4744
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 308
    3⤵
    - Program crash
    PID:1344
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 308
    3⤵
    - Program crash
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 308
    3⤵
    - Program crash
    PID:2360
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 332
    3⤵
    - Program crash
    PID:4400
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 308
    3⤵
    - Program crash
    PID:664
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 308
    3⤵
    - Program crash
    PID:1160
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 308
    3⤵
    - Program crash
    PID:3572
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 308
    3⤵
    - Program crash
    PID:4628
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 308
    3⤵
    - Program crash
    PID:4852
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 308
    3⤵
    - Program crash
    PID:3340
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 308
    3⤵
    - Program crash
    PID:2392
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 308
    3⤵
    - Program crash
    PID:1192
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 308
    3⤵
    - Program crash
    PID:4572
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 308
    3⤵
    - Program crash
    PID:2688
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 316
    3⤵
    - Program crash
    PID:4152
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 308
    3⤵
    - Program crash
    PID:2840
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 308
    3⤵
    - Program crash
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 308
    3⤵
    - Program crash
    PID:2108
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 308
    3⤵
    - Program crash
    PID:3704
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 308
    3⤵
    - Program crash
    PID:3320
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 308
    3⤵
    - Program crash
    PID:220
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 308
    3⤵
    - Program crash
    PID:4988
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 316
    3⤵
    - Program crash
    PID:1908
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 308
    3⤵
    - Program crash
    PID:3860
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 308
    3⤵
    - Program crash
    PID:100
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 308
    3⤵
    - Program crash
    PID:4072
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 312
    3⤵
    - Program crash
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 316
    3⤵
    - Program crash
    PID:3572
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 308
    3⤵
    - Program crash
    PID:4768
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 312
    3⤵
    - Program crash
    PID:2896
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 180
    3⤵
    - Program crash
    PID:4280
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 308
    3⤵
    - Program crash
    PID:4640
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 308
    3⤵
    - Program crash
    PID:224
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 308
    3⤵
    PID:2636
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 312
    3⤵
    PID:2792
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 308
    3⤵
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 308
    3⤵
    PID:2856
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 300
    3⤵
    PID:640
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 320
    3⤵
    PID:2128
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 316
    3⤵
    PID:2828
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 308
    3⤵
    PID:4648
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 308
    3⤵
    PID:3524
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 308
    3⤵
    PID:3276
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 308
    3⤵
    PID:4080
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 316
    3⤵
    PID:4156
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 312
    3⤵
    PID:3924
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 308
    3⤵
    PID:2004
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 308
    3⤵
    PID:1284
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 308
    3⤵
    PID:2240
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 308
    3⤵
    PID:2368
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 308
    3⤵
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 308
    3⤵
    PID:1508
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 308
    3⤵
    PID:1236
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 316
    3⤵
    PID:3960
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 308
    3⤵
    PID:864
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 308
    3⤵
    PID:1532
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 308
    3⤵
    PID:2612
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 308
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 308
    3⤵
    PID:2300
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 308
    3⤵
    PID:4060
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 312
    3⤵
    PID:4236
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 308
    3⤵
    PID:1572
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 308
    3⤵
    PID:1344
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 308
    3⤵
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 308
    3⤵
    PID:100
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 308
    3⤵
    PID:3612
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 152
    3⤵
    PID:3636
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 320
    3⤵
    PID:2412
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 308
    3⤵
    PID:3568
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 316
    3⤵
    PID:2332
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 300
    3⤵
    PID:4360
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 312
    3⤵
    PID:452
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 308
    3⤵
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 308
    3⤵
    PID:1532
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 308
    3⤵
    PID:2840
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 308
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 316
    3⤵
    PID:4692
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 308
    3⤵
    PID:1464
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 308
    3⤵
    PID:1748
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 308
    3⤵
    PID:4748
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 316
    3⤵
    PID:1888
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 308
    3⤵
    PID:3276
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 316
    3⤵
    PID:2004
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 308
    3⤵
    PID:64
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 308
    3⤵
    PID:2656
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 308
    3⤵
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 316
    3⤵
    PID:4652
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 308
    3⤵
    PID:3928
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 316
    3⤵
    PID:956
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 308
    3⤵
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 308
    3⤵
    PID:5092
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 308
    3⤵
    PID:2612
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 308
    3⤵
    PID:3704
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 308
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 308
    3⤵
    PID:1564
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 316
    3⤵
    PID:1060
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 308
    3⤵
    PID:4920
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 308
    3⤵
    PID:2452
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 308
    3⤵
    PID:4156
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 308
    3⤵
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 308
    3⤵
    PID:720
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 308
    3⤵
    PID:2200
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:64
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 316
    3⤵
    PID:432
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 308
    3⤵
    PID:940
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 308
    3⤵
    PID:956
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 308
    3⤵
    PID:2876
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 308
    3⤵
    PID:2412
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 308
    3⤵
    PID:1600
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 308
    3⤵
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 312
    3⤵
    PID:1704
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 308
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 308
    3⤵
    PID:5112
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 308
    3⤵
    PID:1464
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 308
    3⤵
    PID:1060
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 308
    3⤵
    PID:1344
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 316
    3⤵
    PID:4856
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 308
    3⤵
    PID:1552
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 308
    3⤵
    PID:3172
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 192
    3⤵
    PID:4568
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 308
    3⤵
    PID:468
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 308
    3⤵
    PID:636
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 312
    3⤵
    PID:736
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 308
    3⤵
    PID:3536
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 308
    3⤵
    PID:2208
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 308
    3⤵
    PID:4392
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 308
    3⤵
    PID:5024
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 308
    3⤵
    PID:3604
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 308
    3⤵
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 312
    3⤵
    PID:3716
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 308
    3⤵
    PID:2288
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 308
    3⤵
    PID:4260
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 308
    3⤵
    PID:972
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 308
    3⤵
    PID:1648
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 308
    3⤵
    PID:536
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 308
    3⤵
    PID:3248
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 308
    3⤵
    PID:3276
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 308
    3⤵
    PID:3408
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 308
    3⤵
    PID:720
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 308
    3⤵
    PID:3596
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 308
    3⤵
    PID:4200
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 316
    3⤵
    PID:4376
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 308
    3⤵
    PID:2384
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 308
    3⤵
    PID:3480
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 308
    3⤵
    PID:756
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 316
    3⤵
    PID:1576
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 308
    3⤵
    PID:532
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 312
    3⤵
    PID:2792
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 308
    3⤵
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 312
    3⤵
    PID:3184
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 308
    3⤵
    PID:904
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 308
    3⤵
    PID:4032
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 316
    3⤵
    PID:4188
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 308
    3⤵
    PID:700
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 308
    3⤵
    PID:4000
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 308
    3⤵
    PID:1900
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 308
    3⤵
    PID:3276
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 308
    3⤵
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 308
    3⤵
    PID:2832
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 308
    3⤵
    PID:4640
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 308
    3⤵
    PID:2332
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 308
    3⤵
    PID:1912
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 308
    3⤵
    PID:956
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 316
    3⤵
    PID:3144
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 308
    3⤵
    PID:2472
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 308
    3⤵
    PID:2108
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 308
    3⤵
    PID:2216
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 272
    3⤵
    PID:4952
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 300
    3⤵
    PID:3704
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 308
    3⤵
    PID:4696
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 316
    3⤵
    PID:2128
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 308
    3⤵
    PID:1136
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 308
    3⤵
    PID:1648
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 308
    3⤵
    PID:2476
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 316
    3⤵
    PID:2220
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 308
    3⤵
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 316
    3⤵
    PID:4420
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 308
    3⤵
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 308
    3⤵
    PID:3624
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 316
    3⤵
    PID:3912
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 184
    3⤵
    PID:2560
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 308
    3⤵
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 308
    3⤵
    PID:1120
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 308
    3⤵
    PID:4708
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 272
    3⤵
    PID:2472
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 324
    3⤵
    PID:1576
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 308
    3⤵
    PID:2284
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 308
    3⤵
    PID:4728
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 272
    3⤵
    PID:4548
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 308
    3⤵
    PID:4496
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 308
    3⤵
    PID:2872
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 308
    3⤵
    PID:1808
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 308
    3⤵
    PID:4032
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 308
    3⤵
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 308
    3⤵
    PID:4632
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 308
    3⤵
    PID:3360
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 308
    3⤵
    PID:3172
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 308
    3⤵
    PID:1380
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 308
    3⤵
    PID:3124
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 308
    3⤵
    PID:4200
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 316
    3⤵
    PID:3616
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 308
    3⤵
    PID:2972
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 312
    3⤵
    PID:2688
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 188
    3⤵
    PID:2112
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 308
    3⤵
    PID:2116
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 308
    3⤵
    PID:2936
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 312
    3⤵
    PID:3240
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 316
    3⤵
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 308
    3⤵
    PID:3184
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 308
    3⤵
    PID:4372
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 308
    3⤵
    PID:2128
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 308
    3⤵
    PID:4988
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 308
    3⤵
    PID:2140
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 308
    3⤵
    PID:2824
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 308
    3⤵
    PID:2952
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 308
    3⤵
    PID:1616
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 308
    3⤵
    PID:1408
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 308
    3⤵
    PID:1580
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 308
    3⤵
    PID:4968
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 308
    3⤵
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 308
    3⤵
    PID:952
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 312
    3⤵
    PID:4852
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 316
    3⤵
    PID:956
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 308
    3⤵
    PID:3896
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 312
    3⤵
    PID:2388
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 308
    3⤵
    PID:4304
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 308
    3⤵
    PID:1424
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 308
    3⤵
    PID:4264
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 312
    3⤵
    PID:5024
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 308
    3⤵
    PID:1688
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 308
    3⤵
    PID:400
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 316
    3⤵
    PID:2128
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 308
    3⤵
    PID:4436
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 308
    3⤵
    PID:1336
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 308
    3⤵
    PID:4804
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 316
    3⤵
    PID:4000
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 308
    3⤵
    PID:1408
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 308
    3⤵
    PID:3188
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 308
    3⤵
    PID:5080
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 316
    3⤵
    PID:3596
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 308
    3⤵
    PID:4512
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 308
    3⤵
    PID:3208
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 308
    3⤵
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 308
    3⤵
    PID:2972
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 308
    3⤵
    PID:4392
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 308
    3⤵
    PID:2456
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 308
    3⤵
    PID:512
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 308
    3⤵
    PID:3272
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 316
    3⤵
    PID:2944
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 316
    3⤵
    PID:3588
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 308
    3⤵
    PID:2936
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 308
    3⤵
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 308
    3⤵
    PID:4700
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 308
    3⤵
    PID:2380
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 308
    3⤵
    PID:1336
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 308
    3⤵
    PID:2244
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 308
    3⤵
    PID:2952
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 308
    3⤵
    PID:3172
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 316
    3⤵
    PID:1560
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 308
    3⤵
    PID:3408
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 312
    3⤵
    PID:432
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 308
    3⤵
    PID:2392
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 308
    3⤵
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 316
    3⤵
    PID:4780
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 308
    3⤵
    PID:2896
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 308
    3⤵
    PID:4464
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 308
    3⤵
    PID:4236
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 308
    3⤵
    PID:3100
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 316
    3⤵
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 308
    3⤵
    PID:2840
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 308
    3⤵
    PID:4728
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 312
    3⤵
    PID:2556
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 308
    3⤵
    PID:1536
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
    3⤵
    PID:2728
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 308
    3⤵
    PID:1688
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 308
    3⤵
    PID:2656
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 312
    3⤵
    PID:4028
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 308
    3⤵
    PID:3888
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 308
    3⤵
    PID:4132
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 308
    3⤵
    PID:1580
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 308
    3⤵
    PID:3512
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 316
    3⤵
    PID:432
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 308
    3⤵
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 308
    3⤵
    PID:952
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 316
    3⤵
    PID:2832
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 308
    3⤵
    PID:4396
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 316
    3⤵
    PID:4652
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 316
    3⤵
    PID:4392
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 308
    3⤵
    PID:3984
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 308
    3⤵
    PID:1848
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 316
    3⤵
    PID:1160
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 308
    3⤵
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 308
    3⤵
    PID:4044
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 316
    3⤵
    PID:1960
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 308
    3⤵
    PID:400
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 316
    3⤵
    PID:4356
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 308
    3⤵
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 308
    3⤵
    PID:3504
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 312
    3⤵
    PID:3852
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 308
    3⤵
    PID:1532
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 316
    3⤵
    PID:3172
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 308
    3⤵
    PID:5080
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 312
    3⤵
    PID:1552
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 308
    3⤵
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 316
    3⤵
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:980
- C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7571f28c85bc57b873482d6b89f0d70_JaffaCakes118.exe"
  2⤵
  PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3604 -ip 3604
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2388 -ip 2388
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3624 -ip 3624
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3176 -ip 3176
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2528 -ip 2528
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4804 -ip 4804
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 620 -ip 620
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4708 -ip 4708
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 396 -ip 396
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1284 -ip 1284
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1492 -ip 1492
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3392 -ip 3392
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4344 -ip 4344
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1120 -ip 1120
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5028 -ip 5028
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1308 -ip 1308
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1912 -ip 1912
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4824 -ip 4824
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2560 -ip 2560
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4528 -ip 4528
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2636 -ip 2636
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2856 -ip 2856
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2352 -ip 2352
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2872 -ip 2872
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3060 -ip 3060
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3664 -ip 3664
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4784 -ip 4784
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 220 -ip 220
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 972 -ip 972
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1572 -ip 1572
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2292 -ip 2292
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4188 -ip 4188
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3268 -ip 3268
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2808 -ip 2808
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1704 -ip 1704
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1960 -ip 1960
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3600 -ip 3600
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3432 -ip 3432
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1756 -ip 1756
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2044 -ip 2044
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 756 -ip 756
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4752 -ip 4752
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4404 -ip 4404
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 452 -ip 452
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2284 -ip 2284
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2300 -ip 2300
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2288 -ip 2288
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2828 -ip 2828
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4696 -ip 4696
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3496 -ip 3496
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4284 -ip 4284
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2940 -ip 2940
1⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3924 -ip 3924
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3468 -ip 3468
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 692 -ip 692
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2240 -ip 2240
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1120 -ip 1120
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1820 -ip 1820
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3568 -ip 3568
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1912 -ip 1912
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1688 -ip 1688
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3708 -ip 3708
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4516 -ip 4516
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2280 -ip 2280
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1532 -ip 1532
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3684 -ip 3684
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4872 -ip 4872
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1748 -ip 1748
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2228 -ip 2228
1⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5052 -ip 5052
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2968 -ip 2968
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1364 -ip 1364
1⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3360 -ip 3360
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1908 -ip 1908
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2712 -ip 2712
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1964 -ip 1964
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2860 -ip 2860
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4392 -ip 4392
1⤵
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3936 -ip 3936
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1120 -ip 1120
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4640 -ip 4640
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4204 -ip 4204
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1148 -ip 1148
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2280 -ip 2280
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4812 -ip 4812
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3504 -ip 3504
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1488 -ip 1488
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1464 -ip 1464
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2952 -ip 2952
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1288 -ip 1288
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3320 -ip 3320
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3276 -ip 3276
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4932 -ip 4932
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4352 -ip 4352
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3616 -ip 3616
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3924 -ip 3924
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1968 -ip 1968
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2916 -ip 2916
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 624 -ip 624
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4488 -ip 4488
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4372 -ip 4372
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2524 -ip 2524
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4580 -ip 4580
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2380 -ip 2380
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 876 -ip 876
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2140 -ip 2140
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4872 -ip 4872
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4988 -ip 4988
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4744 -ip 4744
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 468 -ip 468
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4876 -ip 4876
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4564 -ip 4564
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2200 -ip 2200
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2196 -ip 2196
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2384 -ip 2384
1⤵
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4044 -ip 4044
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2412 -ip 2412
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5060 -ip 5060
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4488 -ip 4488
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1336 -ip 1336
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3916 -ip 3916
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5032 -ip 5032
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3584 -ip 3584
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 972 -ip 972
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 536 -ip 536
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2528 -ip 2528
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4744 -ip 4744
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 404 -ip 404
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2360 -ip 2360
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 64 -ip 64
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1208 -ip 1208
1⤵
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3928 -ip 3928
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2912 -ip 2912
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3692 -ip 3692
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2592 -ip 2592
1⤵
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2792 -ip 2792
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4372 -ip 4372
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1336 -ip 1336
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 440 -ip 440
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2376 -ip 2376
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3584 -ip 3584
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2720 -ip 2720
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2968 -ip 2968
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4292 -ip 4292
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4420 -ip 4420
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3612 -ip 3612
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1468 -ip 1468
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4744 -ip 4744
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2196 -ip 2196
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3924 -ip 3924
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4708 -ip 4708
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3252 -ip 3252
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3476 -ip 3476
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1532 -ip 1532
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3060 -ip 3060
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2612 -ip 2612
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3952 -ip 3952
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1804 -ip 1804
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5052 -ip 5052
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1564 -ip 1564
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1064 -ip 1064
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 396 -ip 396
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4944 -ip 4944
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1552 -ip 1552
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4636 -ip 4636
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3912 -ip 3912
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4724 -ip 4724
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1468 -ip 1468
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4204 -ip 4204
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2896 -ip 2896
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3536 -ip 3536
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 844 -ip 844
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2996 -ip 2996
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5024 -ip 5024
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2724 -ip 2724
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3664 -ip 3664
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 2380
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4348 -ip 4348
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 740 -ip 740
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1408 -ip 1408
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4980 -ip 4980
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 384 -ip 384
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3396 -ip 3396
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 4568
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1888 -ip 1888
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4512 -ip 4512
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4936 -ip 4936
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2148 -ip 2148
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4304 -ip 4304
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 452 -ip 452
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2916 -ip 2916
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1708 -ip 1708
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2912 -ip 2912
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4700 -ip 4700
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4928 -ip 4928
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1600 -ip 1600
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1464 -ip 1464
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3852 -ip 3852
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3448 -ip 3448
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4132 -ip 4132
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4000 -ip 4000
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3684 -ip 3684
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4556 -ip 4556
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3652 -ip 3652
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1344 -ip 1344
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2032 -ip 2032
1⤵
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1292 -ip 1292
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4636 -ip 4636
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 2112
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2636 -ip 2636
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1836 -ip 1836
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3240 -ip 3240
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4572 -ip 4572
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1532 -ip 1532
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2876 -ip 2876
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4700 -ip 4700
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3952 -ip 3952
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3368 -ip 3368
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4804 -ip 4804
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1464 -ip 1464
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4788 -ip 4788
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1064 -ip 1064
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4932 -ip 4932
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2528 -ip 2528
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4340 -ip 4340
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4852 -ip 4852
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 664 -ip 664
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4352 -ip 4352
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4636 -ip 4636
1⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 320 -ip 320
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2196 -ip 2196
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4828 -ip 4828
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1576 -ip 1576
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2280 -ip 2280
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4548 -ip 4548
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2792 -ip 2792
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5060 -ip 5060
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2376 -ip 2376
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3656 -ip 3656
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4872 -ip 4872
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 396 -ip 396
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4972 -ip 4972
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3744 -ip 3744
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1064 -ip 1064
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4980 -ip 4980
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4916 -ip 4916
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2332 -ip 2332
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3912 -ip 3912
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2044 -ip 2044
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3600 -ip 3600
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 924 -ip 924
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3144 -ip 3144
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 636 -ip 636
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2936 -ip 2936
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2280 -ip 2280
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4696 -ip 4696
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1904 -ip 1904
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1532 -ip 1532
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4080 -ip 4080
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4424 -ip 4424
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3852 -ip 3852
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3032 -ip 3032
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1560 -ip 1560
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4312 -ip 4312
1⤵
PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3612 -ip 3612
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1064 -ip 1064
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3860 -ip 3860
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 744 -ip 744
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4852 -ip 4852
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3120 -ip 3120
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2112 -ip 2112
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4352 -ip 4352
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2388 -ip 2388
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3480 -ip 3480
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2840 -ip 2840
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4908 -ip 4908
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3504 -ip 3504
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1600 -ip 1600
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 936 -ip 936
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1532 -ip 1532
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4440 -ip 4440
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3496 -ip 3496
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4368 -ip 4368
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2476 -ip 2476
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1552 -ip 1552
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4276 -ip 4276
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4420 -ip 4420
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4980 -ip 4980
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3912 -ip 3912
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2884 -ip 2884
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1208 -ip 1208
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3476 -ip 3476
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 180 -ip 180
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3176 -ip 3176
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3480 -ip 3480
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1960 -ip 1960
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1156 -ip 1156
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2724 -ip 2724
1⤵
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 368 -ip 368
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4920 -ip 4920
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4032 -ip 4032
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 440 -ip 440
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3592 -ip 3592
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 700 -ip 700
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1776 -ip 1776
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3612 -ip 3612
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 464 -ip 464
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3796 -ip 3796
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2016 -ip 2016
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3976 -ip 3976
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1912 -ip 1912
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2896 -ip 2896
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4340 -ip 4340
1⤵
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2884 -ip 2884
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2284 -ip 2284
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2636 -ip 2636
1⤵
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 4992
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4728 -ip 4728
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3480 -ip 3480
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1708 -ip 1708
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3584 -ip 3584
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2280 -ip 2280
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4928 -ip 4928
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4032 -ip 4032
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4944 -ip 4944
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 412 -ip 412
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 384 -ip 384
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4312 -ip 4312
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3612 -ip 3612
1⤵
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-15-0x0000000000400000-0x000000000042D452-memory.dmp

Filesize
181KB

Download
memory/3604-0-0x0000000000400000-0x000000000042D452-memory.dmp

Filesize
181KB

Download