49b6f6bfb9353aba5eeed8d4b34ab06e328b4b702c3d2f68bacdacf972b5a97b

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll
Size

3KB
MD5

ce9b24ccb8532f34ebb1086ecf9d0cf0
SHA1

475ae6b03a167657eb8b1634fe1002c60c0edab2
SHA256

49b6f6bfb9353aba5eeed8d4b34ab06e328b4b702c3d2f68bacdacf972b5a97b
SHA512

fcc05f83309c37333b5d43c96ba3427d6249ad82545db7fde354969d442c87f64db2ef1de25c79e420739966d51016895c825e8d68aace97d8dc10efddb4ce7d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2012	5044	rundll32.exe	83
PID 5044 wrote to memory of 2012	5044	rundll32.exe	83
PID 5044 wrote to memory of 2012	5044	rundll32.exe	83
PID 2012 wrote to memory of 912	2012	rundll32.exe	85
PID 2012 wrote to memory of 912	2012	rundll32.exe	85
PID 2012 wrote to memory of 912	2012	rundll32.exe	85
PID 912 wrote to memory of 1936	912	rundll32.exe	86
PID 912 wrote to memory of 1936	912	rundll32.exe	86
PID 912 wrote to memory of 1936	912	rundll32.exe	86
PID 1936 wrote to memory of 976	1936	rundll32.exe	87
PID 1936 wrote to memory of 976	1936	rundll32.exe	87
PID 1936 wrote to memory of 976	1936	rundll32.exe	87
PID 976 wrote to memory of 4636	976	rundll32.exe	88
PID 976 wrote to memory of 4636	976	rundll32.exe	88
PID 976 wrote to memory of 4636	976	rundll32.exe	88
PID 4636 wrote to memory of 3292	4636	rundll32.exe	89
PID 4636 wrote to memory of 3292	4636	rundll32.exe	89
PID 4636 wrote to memory of 3292	4636	rundll32.exe	89
PID 3292 wrote to memory of 4064	3292	rundll32.exe	90
PID 3292 wrote to memory of 4064	3292	rundll32.exe	90
PID 3292 wrote to memory of 4064	3292	rundll32.exe	90
PID 4064 wrote to memory of 3188	4064	rundll32.exe	91
PID 4064 wrote to memory of 3188	4064	rundll32.exe	91
PID 4064 wrote to memory of 3188	4064	rundll32.exe	91
PID 3188 wrote to memory of 3256	3188	rundll32.exe	92
PID 3188 wrote to memory of 3256	3188	rundll32.exe	92
PID 3188 wrote to memory of 3256	3188	rundll32.exe	92
PID 3256 wrote to memory of 676	3256	rundll32.exe	93
PID 3256 wrote to memory of 676	3256	rundll32.exe	93
PID 3256 wrote to memory of 676	3256	rundll32.exe	93
PID 676 wrote to memory of 2400	676	rundll32.exe	94
PID 676 wrote to memory of 2400	676	rundll32.exe	94
PID 676 wrote to memory of 2400	676	rundll32.exe	94
PID 2400 wrote to memory of 4648	2400	rundll32.exe	95
PID 2400 wrote to memory of 4648	2400	rundll32.exe	95
PID 2400 wrote to memory of 4648	2400	rundll32.exe	95
PID 4648 wrote to memory of 3108	4648	rundll32.exe	96
PID 4648 wrote to memory of 3108	4648	rundll32.exe	96
PID 4648 wrote to memory of 3108	4648	rundll32.exe	96
PID 3108 wrote to memory of 2832	3108	rundll32.exe	97
PID 3108 wrote to memory of 2832	3108	rundll32.exe	97
PID 3108 wrote to memory of 2832	3108	rundll32.exe	97
PID 2832 wrote to memory of 3660	2832	rundll32.exe	98
PID 2832 wrote to memory of 3660	2832	rundll32.exe	98
PID 2832 wrote to memory of 3660	2832	rundll32.exe	98
PID 3660 wrote to memory of 4920	3660	rundll32.exe	100
PID 3660 wrote to memory of 4920	3660	rundll32.exe	100
PID 3660 wrote to memory of 4920	3660	rundll32.exe	100
PID 4920 wrote to memory of 2224	4920	rundll32.exe	101
PID 4920 wrote to memory of 2224	4920	rundll32.exe	101
PID 4920 wrote to memory of 2224	4920	rundll32.exe	101
PID 2224 wrote to memory of 5004	2224	rundll32.exe	102
PID 2224 wrote to memory of 5004	2224	rundll32.exe	102
PID 2224 wrote to memory of 5004	2224	rundll32.exe	102
PID 5004 wrote to memory of 1448	5004	rundll32.exe	103
PID 5004 wrote to memory of 1448	5004	rundll32.exe	103
PID 5004 wrote to memory of 1448	5004	rundll32.exe	103
PID 1448 wrote to memory of 2948	1448	rundll32.exe	104
PID 1448 wrote to memory of 2948	1448	rundll32.exe	104
PID 1448 wrote to memory of 2948	1448	rundll32.exe	104
PID 2948 wrote to memory of 1292	2948	rundll32.exe	105
PID 2948 wrote to memory of 1292	2948	rundll32.exe	105
PID 2948 wrote to memory of 1292	2948	rundll32.exe	105
PID 1292 wrote to memory of 1904	1292	rundll32.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:976
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        23⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        24⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        25⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        26⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        27⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        28⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        29⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        30⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        31⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        32⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        33⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        34⤵
        
        PID:860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        35⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        36⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        37⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        38⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        39⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        40⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        42⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        43⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        44⤵
        
        PID:220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        45⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        46⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        47⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        48⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        49⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        50⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        51⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        52⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        53⤵
        
        PID:8
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        54⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        55⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        56⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        57⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        58⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        59⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        60⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        61⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        62⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        63⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        64⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        65⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        66⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        67⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        68⤵
        
        PID:772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        69⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        70⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        72⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        73⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        74⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        76⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        77⤵
        
        PID:800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        78⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        79⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        80⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        81⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        82⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        83⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        84⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        85⤵
        
        PID:968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        86⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        87⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        88⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        89⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        90⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        91⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        92⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        93⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        94⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        95⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        96⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        97⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        98⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        99⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        101⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        102⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        103⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        104⤵
        
        PID:388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        105⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        106⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        107⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        108⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        109⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        110⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        111⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        112⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        113⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        114⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        115⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        116⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        118⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        119⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        120⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        121⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        123⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        124⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        125⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        126⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        127⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        128⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        129⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        130⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        132⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        133⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        134⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        135⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        136⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        137⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        139⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        140⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        141⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        142⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        143⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        144⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        145⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        146⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        147⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        148⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        149⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        150⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        151⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        152⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        153⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        154⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        155⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        156⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        157⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        158⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        159⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        160⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        161⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        162⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        163⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        164⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        165⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        166⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        167⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        168⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        169⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        170⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        171⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        172⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        173⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        174⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        175⤵
        
        PID:988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        177⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        178⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        179⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        180⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        181⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        182⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        183⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        184⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        185⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        186⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        187⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        188⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        189⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        190⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        191⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        192⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        193⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        194⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        195⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        196⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        197⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        198⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        199⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        200⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        202⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        203⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        204⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        205⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        206⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        207⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        208⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        210⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        211⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        212⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        213⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        214⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        215⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        216⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        217⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        218⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        219⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        221⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        222⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        223⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        224⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        225⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        226⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        227⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        228⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        230⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        232⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        233⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        234⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        235⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        236⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        237⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        238⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        239⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        240⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        241⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        242⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        243⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        244⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        245⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        246⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        247⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        248⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        249⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        250⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        251⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        252⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        253⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        254⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        255⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        256⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        257⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        258⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        260⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        261⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        262⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        263⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        264⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        265⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        266⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        267⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        268⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        269⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        270⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        271⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        272⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        273⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        274⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        275⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        276⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        277⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        278⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        279⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        280⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        281⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        282⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        283⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        284⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        285⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        286⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        287⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        288⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        290⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        291⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:7912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        293⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        294⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        295⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        296⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        297⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        298⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        299⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        300⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        301⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        302⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        303⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        304⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        305⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        306⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        307⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        309⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        310⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        311⤵
        
        PID:232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        312⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        313⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        314⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        315⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        317⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        318⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        319⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        320⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        321⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        322⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        323⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        325⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        326⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:8444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        328⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        330⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        331⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        332⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        333⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        334⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        335⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        336⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        337⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        338⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        339⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        340⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        341⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        342⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        343⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        345⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        346⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        347⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        348⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        349⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        350⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        351⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        352⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        353⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        354⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        355⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        356⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        357⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        358⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        361⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        362⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        363⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        364⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        365⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        366⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        367⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        368⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        369⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        370⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        371⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        372⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        373⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        374⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        375⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        376⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:9372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        378⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        379⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        380⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        381⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        382⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        383⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        384⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        385⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        386⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        387⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        388⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        389⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        390⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        391⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        392⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        393⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        394⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        395⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        396⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        397⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        398⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        399⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        400⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        401⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        402⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        403⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        404⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        405⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        406⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        407⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        408⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        409⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        410⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        411⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        412⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        413⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        414⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        415⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        416⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        417⤵
        System Location Discovery: System Language Discovery
        
        PID:9940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        418⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        419⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        420⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        421⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        422⤵
        System Location Discovery: System Language Discovery
        
        PID:10004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        423⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        424⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        425⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        426⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        427⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        428⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        429⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        430⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        431⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        432⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        433⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        434⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        435⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        436⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        437⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        438⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        439⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        440⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        441⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        442⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        443⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        444⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        445⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        446⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        447⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        448⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        449⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        450⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        451⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        452⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        453⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        454⤵
        System Location Discovery: System Language Discovery
        
        PID:10424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        455⤵
        System Location Discovery: System Language Discovery
        
        PID:10440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        456⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        457⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:10476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        459⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:10500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        461⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        462⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        463⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        464⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        465⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        466⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        467⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        468⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        469⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        470⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        471⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        472⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        473⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        474⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        475⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        476⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        477⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        478⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        479⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        480⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        481⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        482⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        483⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        484⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        485⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        486⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        487⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        488⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        489⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        490⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        491⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        492⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        493⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        494⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        495⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        496⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        497⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        498⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        499⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        500⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        501⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        502⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        503⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        504⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        505⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        506⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        507⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        508⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        509⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        510⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        511⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        512⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        513⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        514⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        515⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        516⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        517⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        518⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        519⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        520⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        521⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        522⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        523⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        524⤵
        System Location Discovery: System Language Discovery
        
        PID:11296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        525⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        526⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        527⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        528⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        529⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        530⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        531⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        532⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        533⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:11456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        535⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        536⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        537⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        538⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        539⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        540⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        541⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        542⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        543⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        544⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        545⤵
        System Location Discovery: System Language Discovery
        
        PID:11600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        546⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        547⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        548⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        549⤵
        System Location Discovery: System Language Discovery
        
        PID:11648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        550⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        551⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        552⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        553⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        554⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        555⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:11740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        557⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        558⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        559⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        560⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        561⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        562⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        563⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        564⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        565⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        566⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        567⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        568⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        569⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        570⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        571⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        572⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        573⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        574⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        575⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        576⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        577⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        578⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        579⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        580⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        581⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        582⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        583⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        584⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        585⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        586⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        587⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        588⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        589⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        590⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        591⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        592⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        593⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        594⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        595⤵
        System Location Discovery: System Language Discovery
        
        PID:12232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        596⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        597⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        598⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        599⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        600⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        601⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        602⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        603⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        604⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        605⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        606⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        607⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        608⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        609⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        610⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        611⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        612⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        613⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        614⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        615⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        616⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        617⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        618⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        619⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        620⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        621⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        622⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        623⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        624⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        625⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        626⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        627⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        628⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        629⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        630⤵
        System Location Discovery: System Language Discovery
        
        PID:12668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        631⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        632⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        633⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        634⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        635⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        636⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        637⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        638⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        639⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        640⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        641⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        642⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        643⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        644⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        645⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        646⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        647⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        648⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        649⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        650⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        651⤵
        System Location Discovery: System Language Discovery
        
        PID:12924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        652⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        653⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        654⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        655⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        656⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        657⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        658⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        659⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        660⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        661⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        662⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        663⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        664⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        665⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        666⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        667⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        668⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        669⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        670⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        671⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        672⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        673⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        674⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        675⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        676⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        677⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        678⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        679⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        680⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        681⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        682⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        683⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        684⤵
        
        PID:13344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        685⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        686⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        687⤵
        System Location Discovery: System Language Discovery
        
        PID:13380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        688⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        689⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        690⤵
        
        PID:13416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        691⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        692⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        693⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        694⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        695⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        696⤵
        
        PID:13488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        697⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        698⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        699⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        700⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        701⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        702⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        703⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        704⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        705⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        706⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        707⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        708⤵
        System Location Discovery: System Language Discovery
        
        PID:13644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        709⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        710⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        711⤵
        
        PID:13680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        712⤵
        
        PID:13692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        713⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        714⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        715⤵
        System Location Discovery: System Language Discovery
        
        PID:13728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        716⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        717⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        718⤵
        
        PID:13768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        719⤵
        System Location Discovery: System Language Discovery
        
        PID:13784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        720⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        721⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        722⤵
        
        PID:13820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        723⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        724⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        725⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        726⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        727⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        728⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        729⤵
        
        PID:13916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        730⤵
        
        PID:13928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        731⤵
        
        PID:13944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        732⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        733⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        734⤵
        
        PID:13984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        735⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        736⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        737⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        738⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        739⤵
        System Location Discovery: System Language Discovery
        
        PID:14052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        740⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        741⤵
        
        PID:14076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        742⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        743⤵
        
        PID:14100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        744⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        745⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        746⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        747⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        748⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        749⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        750⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        751⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        752⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        753⤵
        
        PID:14344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        754⤵
        
        PID:14376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        755⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        756⤵
        
        PID:14408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        757⤵
        
        PID:14432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        758⤵
        
        PID:14460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        759⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        760⤵
        
        PID:14492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        761⤵
        
        PID:14504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        762⤵
        
        PID:14516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        763⤵
        System Location Discovery: System Language Discovery
        
        PID:14532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        764⤵
        
        PID:14548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        765⤵
        
        PID:14560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        766⤵
        
        PID:14572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        767⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        768⤵
        
        PID:14608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        769⤵
        
        PID:14620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        770⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        771⤵
        
        PID:14656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        772⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        773⤵
        
        PID:14688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        774⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        775⤵
        
        PID:14720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        776⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        777⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        778⤵
        System Location Discovery: System Language Discovery
        
        PID:14768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        779⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        780⤵
        
        PID:14800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        781⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        782⤵
        
        PID:14832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        783⤵
        
        PID:14848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        784⤵
        
        PID:14864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        785⤵
        
        PID:14876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        786⤵
        
        PID:14892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        787⤵
        System Location Discovery: System Language Discovery
        
        PID:14908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        788⤵
        
        PID:14924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        789⤵
        
        PID:14940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        790⤵
        
        PID:14956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        791⤵
        
        PID:14968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        792⤵
        
        PID:14992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        793⤵
        
        PID:15004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        794⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        795⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        796⤵
        
        PID:15052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        797⤵
        
        PID:15068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        798⤵
        
        PID:15084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        799⤵
        
        PID:15100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        800⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        801⤵
        
        PID:15132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        802⤵
        
        PID:15148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        803⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        804⤵
        
        PID:15180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        805⤵
        
        PID:15196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        806⤵
        
        PID:15212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        807⤵
        
        PID:15228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        808⤵
        
        PID:15244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        809⤵
        
        PID:15260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        810⤵
        
        PID:15272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        811⤵
        
        PID:15284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        812⤵
        
        PID:15304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        813⤵
        
        PID:15320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        814⤵
        
        PID:15332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        815⤵
        
        PID:15344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        816⤵
        
        PID:13884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        817⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        818⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        819⤵
        
        PID:15376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        820⤵
        
        PID:15392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        821⤵
        
        PID:15408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        822⤵
        
        PID:15424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        823⤵
        
        PID:15440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        824⤵
        
        PID:15464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        825⤵
        
        PID:15480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        826⤵
        
        PID:15508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        827⤵
        System Location Discovery: System Language Discovery
        
        PID:15544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        828⤵
        System Location Discovery: System Language Discovery
        
        PID:15556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        829⤵
        
        PID:15576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        830⤵
        
        PID:15596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        831⤵
        
        PID:15612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        832⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        833⤵
        
        PID:15640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        834⤵
        
        PID:15672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        835⤵
        
        PID:15692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        836⤵
        
        PID:15708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        837⤵
        
        PID:15728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        838⤵
        System Location Discovery: System Language Discovery
        
        PID:15740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        839⤵
        
        PID:15760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        840⤵
        
        PID:15784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        841⤵
        System Location Discovery: System Language Discovery
        
        PID:15796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        842⤵
        
        PID:15816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        843⤵
        
        PID:15832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        844⤵
        System Location Discovery: System Language Discovery
        
        PID:15848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        845⤵
        
        PID:15860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        846⤵
        
        PID:15872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        847⤵
        
        PID:15884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        848⤵
        
        PID:15904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        849⤵
        
        PID:15920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        850⤵
        
        PID:15932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        851⤵
        
        PID:15948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        852⤵
        System Location Discovery: System Language Discovery
        
        PID:15972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        853⤵
        
        PID:15988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        854⤵
        
        PID:16004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        855⤵
        
        PID:16020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        856⤵
        System Location Discovery: System Language Discovery
        
        PID:16036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        857⤵
        System Location Discovery: System Language Discovery
        
        PID:16048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        858⤵
        
        PID:16068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        859⤵
        
        PID:16080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        860⤵
        
        PID:16096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        861⤵
        
        PID:16108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        862⤵
        
        PID:16128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        863⤵
        
        PID:16144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        864⤵
        
        PID:16156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        865⤵
        
        PID:16176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        866⤵
        
        PID:16196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        867⤵
        
        PID:16212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        868⤵
        System Location Discovery: System Language Discovery
        
        PID:16224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        869⤵
        
        PID:16240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        870⤵
        System Location Discovery: System Language Discovery
        
        PID:16256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        871⤵
        System Location Discovery: System Language Discovery
        
        PID:16272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        872⤵
        
        PID:16288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        873⤵
        
        PID:16304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        874⤵
        
        PID:16320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        875⤵
        
        PID:16336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        876⤵
        System Location Discovery: System Language Discovery
        
        PID:16348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        877⤵
        
        PID:16368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        878⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        879⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        880⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        881⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        882⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        883⤵
        
        PID:15492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        884⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        885⤵
        
        PID:16184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        886⤵
        
        PID:16400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9b24ccb8532f34ebb1086ecf9d0cf0_JaffaCakes118.dll,#1
        887⤵
        
        PID:16416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8980-1-0x0000000074DF0000-0x0000000075074000-memory.dmp

Filesize
2.5MB

Download
memory/16184-0-0x0000000074DF0000-0x0000000075074000-memory.dmp

Filesize
2.5MB

Download