5ad4d9e95ba634412957b218f8842988359bec28bcaaa6566c32d0330b4b37d7

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll
Size

16KB
MD5

fe43e9342855b1ef581244202c7c0029
SHA1

d179e5da025e1da53ad387a4c7fdbea6af6bd024
SHA256

5ad4d9e95ba634412957b218f8842988359bec28bcaaa6566c32d0330b4b37d7
SHA512

26283a435971f8dad881404478104cd50c7825c36dd722c09bb23d2cde8e36db14896d976055a91d6b0b067004507927a4aacb9dd5737d22b4b438bc96ccd636
SSDEEP

384:nRmJ+GSZ8PF84XH+bBigi4AFni1ixr3Er/w6sxG/91:IkLZ89PXiMeN1ixB6sxGT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2616	2136	rundll32.exe	82
PID 2136 wrote to memory of 2616	2136	rundll32.exe	82
PID 2136 wrote to memory of 2616	2136	rundll32.exe	82
PID 2616 wrote to memory of 4880	2616	rundll32.exe	83
PID 2616 wrote to memory of 4880	2616	rundll32.exe	83
PID 2616 wrote to memory of 4880	2616	rundll32.exe	83
PID 4880 wrote to memory of 1796	4880	rundll32.exe	84
PID 4880 wrote to memory of 1796	4880	rundll32.exe	84
PID 4880 wrote to memory of 1796	4880	rundll32.exe	84
PID 1796 wrote to memory of 4296	1796	rundll32.exe	85
PID 1796 wrote to memory of 4296	1796	rundll32.exe	85
PID 1796 wrote to memory of 4296	1796	rundll32.exe	85
PID 4296 wrote to memory of 2104	4296	rundll32.exe	86
PID 4296 wrote to memory of 2104	4296	rundll32.exe	86
PID 4296 wrote to memory of 2104	4296	rundll32.exe	86
PID 2104 wrote to memory of 2252	2104	rundll32.exe	87
PID 2104 wrote to memory of 2252	2104	rundll32.exe	87
PID 2104 wrote to memory of 2252	2104	rundll32.exe	87
PID 2252 wrote to memory of 3596	2252	rundll32.exe	88
PID 2252 wrote to memory of 3596	2252	rundll32.exe	88
PID 2252 wrote to memory of 3596	2252	rundll32.exe	88
PID 3596 wrote to memory of 1640	3596	rundll32.exe	89
PID 3596 wrote to memory of 1640	3596	rundll32.exe	89
PID 3596 wrote to memory of 1640	3596	rundll32.exe	89
PID 1640 wrote to memory of 3988	1640	rundll32.exe	90
PID 1640 wrote to memory of 3988	1640	rundll32.exe	90
PID 1640 wrote to memory of 3988	1640	rundll32.exe	90
PID 3988 wrote to memory of 1488	3988	rundll32.exe	91
PID 3988 wrote to memory of 1488	3988	rundll32.exe	91
PID 3988 wrote to memory of 1488	3988	rundll32.exe	91
PID 1488 wrote to memory of 2000	1488	rundll32.exe	92
PID 1488 wrote to memory of 2000	1488	rundll32.exe	92
PID 1488 wrote to memory of 2000	1488	rundll32.exe	92
PID 2000 wrote to memory of 2196	2000	rundll32.exe	93
PID 2000 wrote to memory of 2196	2000	rundll32.exe	93
PID 2000 wrote to memory of 2196	2000	rundll32.exe	93
PID 2196 wrote to memory of 4240	2196	rundll32.exe	94
PID 2196 wrote to memory of 4240	2196	rundll32.exe	94
PID 2196 wrote to memory of 4240	2196	rundll32.exe	94
PID 4240 wrote to memory of 3288	4240	rundll32.exe	95
PID 4240 wrote to memory of 3288	4240	rundll32.exe	95
PID 4240 wrote to memory of 3288	4240	rundll32.exe	95
PID 3288 wrote to memory of 3268	3288	rundll32.exe	96
PID 3288 wrote to memory of 3268	3288	rundll32.exe	96
PID 3288 wrote to memory of 3268	3288	rundll32.exe	96
PID 3268 wrote to memory of 1756	3268	rundll32.exe	97
PID 3268 wrote to memory of 1756	3268	rundll32.exe	97
PID 3268 wrote to memory of 1756	3268	rundll32.exe	97
PID 1756 wrote to memory of 536	1756	rundll32.exe	98
PID 1756 wrote to memory of 536	1756	rundll32.exe	98
PID 1756 wrote to memory of 536	1756	rundll32.exe	98
PID 536 wrote to memory of 3484	536	rundll32.exe	99
PID 536 wrote to memory of 3484	536	rundll32.exe	99
PID 536 wrote to memory of 3484	536	rundll32.exe	99
PID 3484 wrote to memory of 4948	3484	rundll32.exe	100
PID 3484 wrote to memory of 4948	3484	rundll32.exe	100
PID 3484 wrote to memory of 4948	3484	rundll32.exe	100
PID 4948 wrote to memory of 3964	4948	rundll32.exe	101
PID 4948 wrote to memory of 3964	4948	rundll32.exe	101
PID 4948 wrote to memory of 3964	4948	rundll32.exe	101
PID 3964 wrote to memory of 3692	3964	rundll32.exe	102
PID 3964 wrote to memory of 3692	3964	rundll32.exe	102
PID 3964 wrote to memory of 3692	3964	rundll32.exe	102
PID 3692 wrote to memory of 3816	3692	rundll32.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        23⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        24⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        25⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        26⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        28⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        29⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        30⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        31⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        32⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        35⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        36⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        37⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        38⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        39⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        40⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        41⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        42⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        43⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        44⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        45⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        46⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        47⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        48⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        49⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        50⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        51⤵
        
        PID:544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        52⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        53⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        54⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        55⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        57⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        58⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        59⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        60⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        61⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        62⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        63⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        64⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        65⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        66⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        67⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        68⤵
        
        PID:848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        69⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        70⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        71⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        72⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        73⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        74⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        75⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        76⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        77⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        78⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        79⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        80⤵
        
        PID:744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        81⤵
        
        PID:808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        82⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        83⤵
        
        PID:460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        84⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        85⤵
        
        PID:436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        86⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        87⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        88⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        89⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        90⤵
        
        PID:912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        91⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        92⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        93⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        94⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        95⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        96⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        98⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        99⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        100⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        101⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        102⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        103⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        104⤵
        
        PID:392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        105⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        106⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        107⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        108⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        109⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        110⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        111⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        112⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        113⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        114⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        115⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        116⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        118⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        119⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        120⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        121⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        122⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        123⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        124⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        125⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        126⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        127⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        128⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        129⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        130⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        131⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        132⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        133⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        134⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        136⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        137⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        138⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        140⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        141⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        143⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        145⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        146⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        147⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        149⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        150⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        151⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        152⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        153⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        154⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        155⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        156⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        157⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        158⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        159⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        160⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        161⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        162⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        163⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        164⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        165⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        166⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        167⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        168⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        169⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        170⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        171⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        172⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        173⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        174⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        175⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        176⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        177⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        178⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        179⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        180⤵
        
        PID:448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        181⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        183⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        184⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        185⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        186⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        187⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        188⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        189⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        190⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        191⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        192⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        193⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        194⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        195⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        196⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        197⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        198⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        199⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        200⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        201⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        202⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        203⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        204⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        205⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        206⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        207⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        208⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        210⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        211⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        214⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        215⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        216⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        217⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        218⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        220⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        221⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        222⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        223⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        224⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        225⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        227⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        228⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        229⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        230⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        231⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        232⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        233⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        234⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        235⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        236⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        237⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        238⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        239⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        241⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        242⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        243⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        244⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        245⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        246⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        248⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        249⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        250⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        251⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        252⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        253⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        254⤵
        
        PID:432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        255⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        256⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        257⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        258⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        259⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        262⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        263⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        264⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        265⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        266⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        267⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        268⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        269⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        270⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        271⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        272⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        273⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        274⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        275⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        276⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        277⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        278⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        279⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        280⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        281⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        283⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        284⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        285⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        286⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        287⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        288⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        289⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        290⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        291⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        292⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        293⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        294⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        295⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        296⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:7996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        298⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        299⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        300⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        301⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        302⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        303⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        304⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        305⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        306⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        307⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        308⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        310⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        311⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        312⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        313⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        314⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        315⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        316⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        317⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        318⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        319⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        320⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        321⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:8324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        323⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        324⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        325⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        326⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        327⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        329⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        330⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        331⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        332⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        333⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        334⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        335⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        336⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        337⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        338⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        339⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        340⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        341⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        343⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        344⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        345⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        346⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        347⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        348⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        349⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        350⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        351⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        352⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        353⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        354⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        355⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        356⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        357⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        358⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        359⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        360⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        361⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        362⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:8920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        364⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        365⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        366⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        367⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        368⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        369⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        370⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        371⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        372⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        373⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        374⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        375⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        376⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        377⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        378⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        379⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        380⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        381⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        382⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        383⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        384⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        385⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        387⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        388⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        389⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        390⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        391⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        392⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        393⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        394⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        395⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        396⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        397⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        398⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        399⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        400⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:9536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        402⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        403⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        404⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        405⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        406⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        407⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        408⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        409⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        410⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        411⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        412⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        413⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        414⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        415⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        416⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        417⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        418⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        419⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        420⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        421⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        422⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        423⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        424⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        425⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        426⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        427⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        428⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        429⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        430⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        432⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        433⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        434⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        435⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        436⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        437⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        438⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        439⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        440⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        441⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        442⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        443⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        444⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        445⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        446⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        447⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        448⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        449⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        450⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        451⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        452⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        453⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        454⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        455⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        456⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        457⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        458⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        459⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        460⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        461⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        462⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        463⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        464⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        465⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        466⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        467⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        468⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        469⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        470⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        471⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        472⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        473⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        474⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        475⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        476⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        477⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        478⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        479⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        480⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        481⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        482⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        483⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        484⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        485⤵
        System Location Discovery: System Language Discovery
        
        PID:10808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        486⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        487⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        488⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        489⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        490⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        491⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        492⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        493⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        494⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        495⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        496⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        497⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        498⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        499⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        500⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        501⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        502⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        503⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        504⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        505⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        506⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        507⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        508⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        509⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        510⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        511⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        512⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        513⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        514⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        515⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        516⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        517⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        518⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        519⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        520⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        521⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        522⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        523⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        524⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        525⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        526⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        527⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        528⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        529⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        530⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        531⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        532⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        533⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        534⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        535⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        536⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        537⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        538⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        539⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        540⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        541⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        542⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        543⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        544⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        545⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        546⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        547⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        548⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        549⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        550⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        551⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        552⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        553⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        554⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        555⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        556⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        557⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        558⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        559⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        560⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        561⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        562⤵
        System Location Discovery: System Language Discovery
        
        PID:12116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        563⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        564⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        565⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        566⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        567⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        568⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        569⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        570⤵
        System Location Discovery: System Language Discovery
        
        PID:12280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        571⤵
        
        PID:928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        572⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        573⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        574⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        575⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        576⤵
        System Location Discovery: System Language Discovery
        
        PID:12368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        577⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        578⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        579⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        580⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        581⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        582⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        583⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        584⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        585⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        586⤵
        System Location Discovery: System Language Discovery
        
        PID:12536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        587⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        588⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        589⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        590⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        591⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        592⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        593⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        594⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        595⤵
        System Location Discovery: System Language Discovery
        
        PID:12700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        596⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        597⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        598⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        599⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        600⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        601⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        602⤵
        System Location Discovery: System Language Discovery
        
        PID:12816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        603⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        604⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        605⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        606⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        607⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        608⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        609⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        610⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        611⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        612⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        613⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        614⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        615⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        616⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        617⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        618⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        619⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        620⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        621⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        622⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        623⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        624⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        625⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        626⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        627⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        628⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        629⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        630⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        631⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        632⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        633⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        634⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        635⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        636⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        637⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        638⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        639⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        640⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        641⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        642⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        643⤵
        
        PID:13348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        644⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        645⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        646⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        647⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        648⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        649⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        650⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        651⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        652⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        653⤵
        System Location Discovery: System Language Discovery
        
        PID:13496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        654⤵
        
        PID:13508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        655⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        656⤵
        System Location Discovery: System Language Discovery
        
        PID:13536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        657⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        658⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        659⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        660⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        661⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        662⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        663⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        664⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        665⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        666⤵
        
        PID:13684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        667⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        668⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        669⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        670⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        671⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        672⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        673⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        674⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        675⤵
        
        PID:13824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        676⤵
        
        PID:13840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        677⤵
        
        PID:13864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        678⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        679⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        680⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        681⤵
        System Location Discovery: System Language Discovery
        
        PID:13928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        682⤵
        
        PID:13948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        683⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        684⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        685⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        686⤵
        System Location Discovery: System Language Discovery
        
        PID:14012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        687⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        688⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        689⤵
        
        PID:14056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        690⤵
        
        PID:14072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        691⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        692⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        693⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        694⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        695⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        696⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        697⤵
        System Location Discovery: System Language Discovery
        
        PID:14168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        698⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        699⤵
        
        PID:14192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        700⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        701⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        702⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        703⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        704⤵
        
        PID:14268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        705⤵
        
        PID:14284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        706⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        707⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        708⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        709⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        710⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        711⤵
        
        PID:14360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        712⤵
        
        PID:14376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        713⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        714⤵
        
        PID:14408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        715⤵
        
        PID:14424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        716⤵
        
        PID:14436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        717⤵
        
        PID:14456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        718⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        719⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        720⤵
        
        PID:14500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        721⤵
        
        PID:14516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        722⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        723⤵
        
        PID:14548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        724⤵
        
        PID:14560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        725⤵
        
        PID:14576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        726⤵
        
        PID:14588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        727⤵
        
        PID:14604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        728⤵
        
        PID:14620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        729⤵
        
        PID:14636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        730⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        731⤵
        
        PID:14660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        732⤵
        
        PID:14676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        733⤵
        
        PID:14692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        734⤵
        
        PID:14708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        735⤵
        
        PID:14720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        736⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        737⤵
        
        PID:14756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        738⤵
        
        PID:14768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        739⤵
        System Location Discovery: System Language Discovery
        
        PID:14780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        740⤵
        
        PID:14796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        741⤵
        
        PID:14812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        742⤵
        
        PID:14828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        743⤵
        
        PID:14844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        744⤵
        
        PID:14860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        745⤵
        
        PID:14876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        746⤵
        
        PID:14888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        747⤵
        
        PID:14900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        748⤵
        
        PID:14916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        749⤵
        
        PID:14932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        750⤵
        
        PID:14948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        751⤵
        
        PID:14964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        752⤵
        
        PID:14980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        753⤵
        
        PID:14996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        754⤵
        
        PID:15008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        755⤵
        
        PID:15024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        756⤵
        
        PID:15040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        757⤵
        
        PID:15056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        758⤵
        
        PID:15068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        759⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        760⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        761⤵
        
        PID:15112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        762⤵
        System Location Discovery: System Language Discovery
        
        PID:15124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        763⤵
        
        PID:15140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        764⤵
        
        PID:15152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        765⤵
        
        PID:15168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        766⤵
        
        PID:15184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        767⤵
        
        PID:15196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        768⤵
        
        PID:15212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        769⤵
        
        PID:15232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        770⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        771⤵
        
        PID:15264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        772⤵
        
        PID:15280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        773⤵
        System Location Discovery: System Language Discovery
        
        PID:15292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        774⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        775⤵
        System Location Discovery: System Language Discovery
        
        PID:15320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        776⤵
        
        PID:15336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        777⤵
        
        PID:15352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        778⤵
        
        PID:15364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        779⤵
        
        PID:15380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        780⤵
        
        PID:15396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        781⤵
        System Location Discovery: System Language Discovery
        
        PID:15412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        782⤵
        
        PID:15428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        783⤵
        
        PID:15444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        784⤵
        
        PID:15460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        785⤵
        
        PID:15476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        786⤵
        
        PID:15492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        787⤵
        
        PID:15508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        788⤵
        
        PID:15524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        789⤵
        
        PID:15540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        790⤵
        
        PID:15556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        791⤵
        
        PID:15572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        792⤵
        
        PID:15588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        793⤵
        
        PID:15600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        794⤵
        System Location Discovery: System Language Discovery
        
        PID:15620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        795⤵
        
        PID:15636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        796⤵
        
        PID:15652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        797⤵
        
        PID:15668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        798⤵
        
        PID:15684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        799⤵
        
        PID:15700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        800⤵
        
        PID:15716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        801⤵
        
        PID:15732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        802⤵
        
        PID:15748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        803⤵
        
        PID:15764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        804⤵
        
        PID:15780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        805⤵
        
        PID:15796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        806⤵
        
        PID:15812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        807⤵
        
        PID:15824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        808⤵
        
        PID:15840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        809⤵
        
        PID:15856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        810⤵
        
        PID:15868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        811⤵
        System Location Discovery: System Language Discovery
        
        PID:15888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        812⤵
        
        PID:15904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        813⤵
        
        PID:15916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        814⤵
        
        PID:15932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        815⤵
        
        PID:15948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        816⤵
        
        PID:15960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        817⤵
        
        PID:15976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        818⤵
        
        PID:15988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        819⤵
        System Location Discovery: System Language Discovery
        
        PID:16004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        820⤵
        System Location Discovery: System Language Discovery
        
        PID:16020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        821⤵
        
        PID:16036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        822⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        823⤵
        System Location Discovery: System Language Discovery
        
        PID:16064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        824⤵
        
        PID:16080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        825⤵
        
        PID:16096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        826⤵
        System Location Discovery: System Language Discovery
        
        PID:16112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        827⤵
        
        PID:16128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        828⤵
        
        PID:16144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        829⤵
        
        PID:16156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        830⤵
        
        PID:16172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        831⤵
        
        PID:16184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        832⤵
        
        PID:16200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        833⤵
        
        PID:16216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        834⤵
        
        PID:16232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        835⤵
        
        PID:16248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        836⤵
        System Location Discovery: System Language Discovery
        
        PID:16264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        837⤵
        System Location Discovery: System Language Discovery
        
        PID:16276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        838⤵
        
        PID:16292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        839⤵
        
        PID:16308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        840⤵
        
        PID:16324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        841⤵
        
        PID:16340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        842⤵
        
        PID:16356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        843⤵
        
        PID:16372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        844⤵
        
        PID:15220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        845⤵
        
        PID:16396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        846⤵
        
        PID:16412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        847⤵
        
        PID:16428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        848⤵
        System Location Discovery: System Language Discovery
        
        PID:16444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        849⤵
        
        PID:16460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        850⤵
        
        PID:16476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        851⤵
        
        PID:16492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        852⤵
        
        PID:16508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        853⤵
        
        PID:16528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        854⤵
        
        PID:16544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        855⤵
        
        PID:16556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        856⤵
        
        PID:16572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        857⤵
        
        PID:16588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        858⤵
        
        PID:16604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        859⤵
        
        PID:16620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        860⤵
        
        PID:16636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        861⤵
        
        PID:16652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        862⤵
        
        PID:16668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        863⤵
        
        PID:16684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        864⤵
        
        PID:16696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        865⤵
        
        PID:16712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        866⤵
        
        PID:16724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        867⤵
        
        PID:16740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        868⤵
        System Location Discovery: System Language Discovery
        
        PID:16752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        869⤵
        
        PID:16768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        870⤵
        
        PID:16780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        871⤵
        
        PID:16792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        872⤵
        
        PID:16808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        873⤵
        
        PID:16824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        874⤵
        
        PID:16836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        875⤵
        
        PID:16848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        876⤵
        
        PID:16864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        877⤵
        
        PID:16876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        878⤵
        
        PID:16892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        879⤵
        
        PID:16908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        880⤵
        
        PID:16920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        881⤵
        
        PID:16936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        882⤵
        
        PID:16948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        883⤵
        
        PID:16964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe43e9342855b1ef581244202c7c0029_JaffaCakes118.dll,#1
        884⤵
        
        PID:16980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/16920-1-0x0000000074BF0000-0x0000000074E74000-memory.dmp

Filesize
2.5MB

Download
memory/16936-0-0x0000000074BF0000-0x0000000074E74000-memory.dmp

Filesize
2.5MB

Download