83d0a72e6871188c0fa9ca1ab9ad51bced423c15ef76159b2996fcd018629f40

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll
Size

355KB
MD5

dd54424c8ca8efbefc17711898b42b72
SHA1

a325cf8fab27962b7e0b45b37b6621fd39a2c150
SHA256

83d0a72e6871188c0fa9ca1ab9ad51bced423c15ef76159b2996fcd018629f40
SHA512

f9935dfb7a83eb2c4e366f021185a426a44e268a8bfecaeb4f9a1de7c94dda1ffd2112c9a9285cf5ab57d3300da578a091ec57b1ebbcaa121a72a0754ed2d316
SSDEEP

6144:ff3d1LJ7YwoGaXkVqfIhIuhZwjKv/+DdLcriqjNptGh3l:zOijVqfIZfwjKvgBq9Gh3l

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3244	4808	rundll32.exe	90
PID 4808 wrote to memory of 3244	4808	rundll32.exe	90
PID 4808 wrote to memory of 3244	4808	rundll32.exe	90
PID 3244 wrote to memory of 1292	3244	rundll32.exe	91
PID 3244 wrote to memory of 1292	3244	rundll32.exe	91
PID 3244 wrote to memory of 1292	3244	rundll32.exe	91
PID 1292 wrote to memory of 4632	1292	rundll32.exe	92
PID 1292 wrote to memory of 4632	1292	rundll32.exe	92
PID 1292 wrote to memory of 4632	1292	rundll32.exe	92
PID 4632 wrote to memory of 1484	4632	rundll32.exe	93
PID 4632 wrote to memory of 1484	4632	rundll32.exe	93
PID 4632 wrote to memory of 1484	4632	rundll32.exe	93
PID 1484 wrote to memory of 5088	1484	rundll32.exe	94
PID 1484 wrote to memory of 5088	1484	rundll32.exe	94
PID 1484 wrote to memory of 5088	1484	rundll32.exe	94
PID 5088 wrote to memory of 5024	5088	rundll32.exe	96
PID 5088 wrote to memory of 5024	5088	rundll32.exe	96
PID 5088 wrote to memory of 5024	5088	rundll32.exe	96
PID 5024 wrote to memory of 4576	5024	rundll32.exe	97
PID 5024 wrote to memory of 4576	5024	rundll32.exe	97
PID 5024 wrote to memory of 4576	5024	rundll32.exe	97
PID 4576 wrote to memory of 3368	4576	rundll32.exe	98
PID 4576 wrote to memory of 3368	4576	rundll32.exe	98
PID 4576 wrote to memory of 3368	4576	rundll32.exe	98
PID 3368 wrote to memory of 2496	3368	rundll32.exe	99
PID 3368 wrote to memory of 2496	3368	rundll32.exe	99
PID 3368 wrote to memory of 2496	3368	rundll32.exe	99
PID 2496 wrote to memory of 3644	2496	rundll32.exe	100
PID 2496 wrote to memory of 3644	2496	rundll32.exe	100
PID 2496 wrote to memory of 3644	2496	rundll32.exe	100
PID 3644 wrote to memory of 2020	3644	rundll32.exe	101
PID 3644 wrote to memory of 2020	3644	rundll32.exe	101
PID 3644 wrote to memory of 2020	3644	rundll32.exe	101
PID 2020 wrote to memory of 4256	2020	rundll32.exe	102
PID 2020 wrote to memory of 4256	2020	rundll32.exe	102
PID 2020 wrote to memory of 4256	2020	rundll32.exe	102
PID 4256 wrote to memory of 3840	4256	rundll32.exe	103
PID 4256 wrote to memory of 3840	4256	rundll32.exe	103
PID 4256 wrote to memory of 3840	4256	rundll32.exe	103
PID 3840 wrote to memory of 3500	3840	rundll32.exe	104
PID 3840 wrote to memory of 3500	3840	rundll32.exe	104
PID 3840 wrote to memory of 3500	3840	rundll32.exe	104
PID 3500 wrote to memory of 2036	3500	rundll32.exe	105
PID 3500 wrote to memory of 2036	3500	rundll32.exe	105
PID 3500 wrote to memory of 2036	3500	rundll32.exe	105
PID 2036 wrote to memory of 4036	2036	rundll32.exe	106
PID 2036 wrote to memory of 4036	2036	rundll32.exe	106
PID 2036 wrote to memory of 4036	2036	rundll32.exe	106
PID 4036 wrote to memory of 1356	4036	rundll32.exe	107
PID 4036 wrote to memory of 1356	4036	rundll32.exe	107
PID 4036 wrote to memory of 1356	4036	rundll32.exe	107
PID 1356 wrote to memory of 312	1356	rundll32.exe	108
PID 1356 wrote to memory of 312	1356	rundll32.exe	108
PID 1356 wrote to memory of 312	1356	rundll32.exe	108
PID 312 wrote to memory of 1832	312	rundll32.exe	109
PID 312 wrote to memory of 1832	312	rundll32.exe	109
PID 312 wrote to memory of 1832	312	rundll32.exe	109
PID 1832 wrote to memory of 1504	1832	rundll32.exe	110
PID 1832 wrote to memory of 1504	1832	rundll32.exe	110
PID 1832 wrote to memory of 1504	1832	rundll32.exe	110
PID 1504 wrote to memory of 1744	1504	rundll32.exe	111
PID 1504 wrote to memory of 1744	1504	rundll32.exe	111
PID 1504 wrote to memory of 1744	1504	rundll32.exe	111
PID 1744 wrote to memory of 220	1744	rundll32.exe	112

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        23⤵
        
        PID:220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        24⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        25⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        26⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        27⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        28⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        29⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        30⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        31⤵
        
        PID:368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        33⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        34⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        36⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        37⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        38⤵
        
        PID:700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        39⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        40⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        41⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        42⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        43⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        45⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        46⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        47⤵
        
        PID:916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        48⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        49⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        50⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        51⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        52⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        53⤵
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        55⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        56⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        57⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        58⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        59⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        60⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        61⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        62⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        63⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        64⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        65⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        66⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        67⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        68⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        69⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        70⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        71⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        72⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        73⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        74⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        76⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        77⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        78⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        79⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        80⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        81⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        82⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        83⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        84⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        85⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        86⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        87⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        88⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        89⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        91⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        92⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        93⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        94⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        95⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        96⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        97⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        98⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        99⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        100⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        101⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        102⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        103⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        104⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        105⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        106⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        107⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        109⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        110⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        111⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        112⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        113⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        114⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        115⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        116⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        117⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        118⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        119⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        120⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        121⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        122⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        123⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        124⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        125⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        126⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        127⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        128⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        130⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        131⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        132⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        133⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        134⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        135⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        137⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        138⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        139⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        140⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        141⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        142⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        143⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        144⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        145⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        146⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        147⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        148⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        149⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        150⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        152⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        153⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        154⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        155⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        156⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        157⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        158⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        159⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        160⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        162⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        163⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        164⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        165⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        166⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        167⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        168⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        169⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        170⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        171⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        172⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        173⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        174⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        175⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        176⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        177⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        178⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        179⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        181⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        183⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        184⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        185⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        186⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        187⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        188⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        189⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        190⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        191⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        192⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        193⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        194⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        195⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        196⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        197⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        198⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        199⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        200⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        201⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        202⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        203⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        204⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        205⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        206⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        207⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        208⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        209⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        210⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        211⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        212⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        213⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        214⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        215⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        216⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        217⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        218⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        219⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        220⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        221⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        222⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        223⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        224⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        225⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        226⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        227⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        228⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        229⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        230⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        231⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        232⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        233⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        234⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        235⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        236⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:7908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        238⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        239⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:7948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        241⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        242⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        243⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        244⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        245⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        246⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        247⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        248⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        249⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        250⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        251⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        252⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        253⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:8156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        255⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        256⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        257⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        258⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        259⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        260⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        261⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        262⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        263⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        264⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        265⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        266⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        267⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:8292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        269⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        270⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        271⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        272⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        273⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        274⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        275⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        276⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        277⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        278⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        279⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        280⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        281⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        282⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        283⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        284⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        285⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        286⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        288⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        289⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        290⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        291⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        292⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        293⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        294⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        295⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        296⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        297⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        298⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        299⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        300⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        302⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        303⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        304⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        305⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        306⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:9020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        308⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        309⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        310⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        311⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        312⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        313⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        314⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        315⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        316⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        317⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        318⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        319⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        320⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        321⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        322⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        323⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        324⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        325⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        326⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        327⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        328⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        329⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        330⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        331⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        332⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        333⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        334⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        335⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        336⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        337⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        338⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        339⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        340⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        341⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        342⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        343⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        344⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        345⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        346⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        347⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        348⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        349⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        350⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        351⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        352⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        353⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        354⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        355⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        356⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        357⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        358⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        359⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        360⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        361⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        362⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        363⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        364⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        365⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:9900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        368⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        369⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        370⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        371⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        372⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        373⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        374⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        375⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        376⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        377⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        378⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        379⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        380⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        381⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        382⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        383⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        384⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        385⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        386⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        387⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        388⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        389⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        390⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        391⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        392⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        393⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        394⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        395⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        396⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        397⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        398⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:10272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        400⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        401⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:10320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        403⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        404⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        405⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        406⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        407⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        408⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        409⤵
        System Location Discovery: System Language Discovery
        
        PID:10424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        410⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        411⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        412⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        413⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        414⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        415⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        416⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        417⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        418⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        419⤵
        System Location Discovery: System Language Discovery
        
        PID:10564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        420⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        421⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        422⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        423⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        424⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        425⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        426⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        427⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        428⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        429⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        430⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        431⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        432⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        433⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        434⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        435⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        436⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        437⤵
        System Location Discovery: System Language Discovery
        
        PID:10864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:10880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        439⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        440⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        441⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        442⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        443⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        444⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        445⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        446⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        447⤵
        System Location Discovery: System Language Discovery
        
        PID:11040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        448⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        449⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        450⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        451⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:11116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        453⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        454⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        455⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        456⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        457⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        458⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        459⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        460⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        461⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        462⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        463⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        464⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        465⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        466⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        467⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        468⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        469⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:11344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        471⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        472⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        473⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        474⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        475⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        476⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        477⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        478⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        479⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        480⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        481⤵
        System Location Discovery: System Language Discovery
        
        PID:11504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        482⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        483⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        484⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        485⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        486⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        487⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        488⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        489⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        490⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        491⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        492⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        493⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        494⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        495⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        496⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        497⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        498⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        499⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        500⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        501⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        502⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        503⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        504⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        505⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        506⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        507⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        508⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        509⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        510⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        511⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        512⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        513⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        514⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        515⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        516⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        517⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        518⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        519⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        520⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        521⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        522⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        523⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        524⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        525⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        526⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        527⤵
        System Location Discovery: System Language Discovery
        
        PID:12172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        528⤵
        System Location Discovery: System Language Discovery
        
        PID:12188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        529⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        530⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        531⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        532⤵
        System Location Discovery: System Language Discovery
        
        PID:12248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        533⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        534⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        535⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        536⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        537⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        538⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        539⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        540⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        541⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        542⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        543⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        544⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        545⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        546⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        547⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        548⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        549⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        550⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        551⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        552⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        553⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        554⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        555⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        556⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        557⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        558⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        559⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        560⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        561⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        562⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        563⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        564⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        565⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        566⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        567⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        568⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        569⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        570⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        571⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        572⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        573⤵
        System Location Discovery: System Language Discovery
        
        PID:12812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        574⤵
        System Location Discovery: System Language Discovery
        
        PID:12824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        575⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        576⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        577⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        578⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        579⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        580⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        581⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        582⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        583⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        584⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        585⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        586⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        587⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        588⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        589⤵
        System Location Discovery: System Language Discovery
        
        PID:13044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        590⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        591⤵
        System Location Discovery: System Language Discovery
        
        PID:13076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        592⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        593⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        594⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        595⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        596⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        597⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        598⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        599⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        600⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        601⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        602⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        603⤵
        System Location Discovery: System Language Discovery
        
        PID:13248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        604⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        605⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        606⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        607⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        608⤵
        System Location Discovery: System Language Discovery
        
        PID:13320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        609⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        610⤵
        
        PID:13352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        611⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        612⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        613⤵
        System Location Discovery: System Language Discovery
        
        PID:13388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        614⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        615⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        616⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        617⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        618⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        619⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        620⤵
        
        PID:13488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        621⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        622⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        623⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        624⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        625⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        626⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        627⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        628⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        629⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        630⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        631⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        632⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        633⤵
        
        PID:13684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        634⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        635⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        636⤵
        
        PID:13720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        637⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        638⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        639⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        640⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        641⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        642⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        643⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        644⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        645⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        646⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        647⤵
        System Location Discovery: System Language Discovery
        
        PID:13880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        648⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        649⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        650⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        651⤵
        
        PID:13940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        652⤵
        
        PID:13952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        653⤵
        
        PID:13968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        654⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        655⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        656⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        657⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        658⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        659⤵
        System Location Discovery: System Language Discovery
        
        PID:14048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        660⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        661⤵
        
        PID:14076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        662⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        663⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        664⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        665⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        666⤵
        
        PID:14148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        667⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        668⤵
        System Location Discovery: System Language Discovery
        
        PID:14180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        669⤵
        
        PID:14192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        670⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        671⤵
        
        PID:14220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        672⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        673⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        674⤵
        
        PID:14268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        675⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        676⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        677⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        678⤵
        System Location Discovery: System Language Discovery
        
        PID:14324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        679⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        680⤵
        
        PID:14348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        681⤵
        
        PID:14364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        682⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        683⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        684⤵
        
        PID:14412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        685⤵
        
        PID:14428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        686⤵
        
        PID:14440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        687⤵
        System Location Discovery: System Language Discovery
        
        PID:14456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        688⤵
        
        PID:14472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        689⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        690⤵
        
        PID:14500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        691⤵
        
        PID:14512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        692⤵
        
        PID:14528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        693⤵
        
        PID:14544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        694⤵
        
        PID:14556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        695⤵
        
        PID:14572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        696⤵
        
        PID:14584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        697⤵
        System Location Discovery: System Language Discovery
        
        PID:14596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        698⤵
        
        PID:14608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        699⤵
        
        PID:14620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        700⤵
        
        PID:14636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        701⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        702⤵
        
        PID:14664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        703⤵
        
        PID:14676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        704⤵
        
        PID:14692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        705⤵
        
        PID:14708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        706⤵
        
        PID:14724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        707⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        708⤵
        System Location Discovery: System Language Discovery
        
        PID:14756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        709⤵
        
        PID:14768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        710⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        711⤵
        System Location Discovery: System Language Discovery
        
        PID:14804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        712⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        713⤵
        
        PID:14828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        714⤵
        
        PID:14844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        715⤵
        
        PID:14860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        716⤵
        
        PID:14876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        717⤵
        
        PID:14888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        718⤵
        
        PID:14904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        719⤵
        
        PID:14916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        720⤵
        
        PID:14932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        721⤵
        
        PID:14944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        722⤵
        
        PID:14960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        723⤵
        
        PID:14972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        724⤵
        System Location Discovery: System Language Discovery
        
        PID:14992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        725⤵
        
        PID:15004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        726⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        727⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        728⤵
        
        PID:15052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        729⤵
        
        PID:15068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        730⤵
        
        PID:15084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        731⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        732⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        733⤵
        
        PID:15132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        734⤵
        
        PID:15148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        735⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        736⤵
        
        PID:15180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        737⤵
        
        PID:15192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        738⤵
        
        PID:15212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        739⤵
        
        PID:15224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        740⤵
        
        PID:15240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        741⤵
        
        PID:15256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        742⤵
        
        PID:15272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        743⤵
        System Location Discovery: System Language Discovery
        
        PID:15288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        744⤵
        
        PID:15304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        745⤵
        
        PID:15316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        746⤵
        
        PID:15336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        747⤵
        
        PID:15352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        748⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        749⤵
        
        PID:15372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        750⤵
        
        PID:15388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        751⤵
        
        PID:15404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        752⤵
        
        PID:15420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        753⤵
        
        PID:15436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        754⤵
        
        PID:15448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        755⤵
        
        PID:15464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        756⤵
        
        PID:15480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        757⤵
        
        PID:15496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        758⤵
        
        PID:15508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        759⤵
        
        PID:15524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        760⤵
        
        PID:15540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        761⤵
        
        PID:15556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        762⤵
        
        PID:15572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        763⤵
        
        PID:15588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        764⤵
        
        PID:15604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        765⤵
        
        PID:15620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        766⤵
        
        PID:15636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        767⤵
        
        PID:15652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        768⤵
        
        PID:15668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        769⤵
        
        PID:15684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        770⤵
        
        PID:15700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        771⤵
        
        PID:15712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        772⤵
        
        PID:15728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        773⤵
        
        PID:15744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        774⤵
        
        PID:15760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        775⤵
        
        PID:15780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        776⤵
        
        PID:15796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        777⤵
        System Location Discovery: System Language Discovery
        
        PID:15812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        778⤵
        
        PID:15828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        779⤵
        
        PID:15844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        780⤵
        
        PID:15856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        781⤵
        
        PID:15872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        782⤵
        
        PID:15884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        783⤵
        
        PID:15900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        784⤵
        
        PID:15916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        785⤵
        
        PID:15932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        786⤵
        
        PID:15948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        787⤵
        
        PID:15964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        788⤵
        
        PID:15980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        789⤵
        
        PID:15996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        790⤵
        
        PID:16012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        791⤵
        
        PID:16028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        792⤵
        System Location Discovery: System Language Discovery
        
        PID:16044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        793⤵
        
        PID:16060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        794⤵
        
        PID:16072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        795⤵
        
        PID:16092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        796⤵
        System Location Discovery: System Language Discovery
        
        PID:16108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        797⤵
        
        PID:16124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        798⤵
        
        PID:16136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        799⤵
        
        PID:16148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        800⤵
        
        PID:16164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        801⤵
        
        PID:16176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        802⤵
        
        PID:16188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        803⤵
        
        PID:16204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        804⤵
        
        PID:16220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        805⤵
        
        PID:16232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        806⤵
        
        PID:16244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        807⤵
        System Location Discovery: System Language Discovery
        
        PID:16264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        808⤵
        
        PID:16276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        809⤵
        
        PID:16292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        810⤵
        
        PID:16308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        811⤵
        
        PID:16324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        812⤵
        
        PID:16340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        813⤵
        
        PID:16356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        814⤵
        
        PID:16372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        815⤵
        
        PID:15768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        816⤵
        
        PID:16400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        817⤵
        
        PID:16416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        818⤵
        
        PID:16428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        819⤵
        
        PID:16444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        820⤵
        
        PID:16460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        821⤵
        
        PID:16476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        822⤵
        
        PID:16488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        823⤵
        
        PID:16504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        824⤵
        
        PID:16520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        825⤵
        
        PID:16536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        826⤵
        
        PID:16552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        827⤵
        
        PID:16568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        828⤵
        
        PID:16580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        829⤵
        
        PID:16596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        830⤵
        
        PID:16608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        831⤵
        
        PID:16620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        832⤵
        
        PID:16640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        833⤵
        
        PID:16656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        834⤵
        
        PID:16668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        835⤵
        
        PID:16680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        836⤵
        
        PID:16700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        837⤵
        
        PID:16716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        838⤵
        
        PID:16732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        839⤵
        
        PID:16748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        840⤵
        
        PID:16760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        841⤵
        System Location Discovery: System Language Discovery
        
        PID:16772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        842⤵
        
        PID:16788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        843⤵
        
        PID:16804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        844⤵
        
        PID:16820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        845⤵
        
        PID:16840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        846⤵
        
        PID:16856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        847⤵
        
        PID:16868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        848⤵
        
        PID:16880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        849⤵
        
        PID:16896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        850⤵
        
        PID:16912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        851⤵
        
        PID:16928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        852⤵
        
        PID:16944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd54424c8ca8efbefc17711898b42b72_JaffaCakes118.dll,#1
        853⤵
        
        PID:16960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
1⤵
PID:9056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-0-0x0000000074AA0000-0x0000000074D24000-memory.dmp

Filesize
2.5MB

Download