7fca3e21f00e72b89bc60a6a35e7720ff8e0e7cb524eb837bd1b456073df223d

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll
Size

20KB
MD5

147b7692775c4628221838fd5bf0972a
SHA1

dd489e4abca7f3d4f98d03a04d38367b7fcc7ad6
SHA256

7fca3e21f00e72b89bc60a6a35e7720ff8e0e7cb524eb837bd1b456073df223d
SHA512

888370b9729dd66fd5ce15ed0916e5a1f0267479d20095e3b5a17a2f253efe2769a8b664742e5b4cb941884bb3cb3794305cdd1c9c9191f0882c295290c6e372
SSDEEP

384:Doc+E/F0x8RkqP2SLFUTjtCrv9GUQ8AeuuslljKHH8wOPXmwrES:Doc+E/F0x6kqP2SKTjtCRGUQ/3Kn8JPt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3600	4588	rundll32.exe	82
PID 4588 wrote to memory of 3600	4588	rundll32.exe	82
PID 4588 wrote to memory of 3600	4588	rundll32.exe	82
PID 3600 wrote to memory of 1344	3600	rundll32.exe	83
PID 3600 wrote to memory of 1344	3600	rundll32.exe	83
PID 3600 wrote to memory of 1344	3600	rundll32.exe	83
PID 1344 wrote to memory of 3580	1344	rundll32.exe	84
PID 1344 wrote to memory of 3580	1344	rundll32.exe	84
PID 1344 wrote to memory of 3580	1344	rundll32.exe	84
PID 3580 wrote to memory of 512	3580	rundll32.exe	85
PID 3580 wrote to memory of 512	3580	rundll32.exe	85
PID 3580 wrote to memory of 512	3580	rundll32.exe	85
PID 512 wrote to memory of 640	512	rundll32.exe	86
PID 512 wrote to memory of 640	512	rundll32.exe	86
PID 512 wrote to memory of 640	512	rundll32.exe	86
PID 640 wrote to memory of 3280	640	rundll32.exe	87
PID 640 wrote to memory of 3280	640	rundll32.exe	87
PID 640 wrote to memory of 3280	640	rundll32.exe	87
PID 3280 wrote to memory of 3264	3280	rundll32.exe	88
PID 3280 wrote to memory of 3264	3280	rundll32.exe	88
PID 3280 wrote to memory of 3264	3280	rundll32.exe	88
PID 3264 wrote to memory of 1940	3264	rundll32.exe	89
PID 3264 wrote to memory of 1940	3264	rundll32.exe	89
PID 3264 wrote to memory of 1940	3264	rundll32.exe	89
PID 1940 wrote to memory of 2372	1940	rundll32.exe	90
PID 1940 wrote to memory of 2372	1940	rundll32.exe	90
PID 1940 wrote to memory of 2372	1940	rundll32.exe	90
PID 2372 wrote to memory of 4120	2372	rundll32.exe	91
PID 2372 wrote to memory of 4120	2372	rundll32.exe	91
PID 2372 wrote to memory of 4120	2372	rundll32.exe	91
PID 4120 wrote to memory of 5096	4120	rundll32.exe	92
PID 4120 wrote to memory of 5096	4120	rundll32.exe	92
PID 4120 wrote to memory of 5096	4120	rundll32.exe	92
PID 5096 wrote to memory of 4308	5096	rundll32.exe	93
PID 5096 wrote to memory of 4308	5096	rundll32.exe	93
PID 5096 wrote to memory of 4308	5096	rundll32.exe	93
PID 4308 wrote to memory of 1780	4308	rundll32.exe	94
PID 4308 wrote to memory of 1780	4308	rundll32.exe	94
PID 4308 wrote to memory of 1780	4308	rundll32.exe	94
PID 1780 wrote to memory of 3752	1780	rundll32.exe	95
PID 1780 wrote to memory of 3752	1780	rundll32.exe	95
PID 1780 wrote to memory of 3752	1780	rundll32.exe	95
PID 3752 wrote to memory of 4244	3752	rundll32.exe	96
PID 3752 wrote to memory of 4244	3752	rundll32.exe	96
PID 3752 wrote to memory of 4244	3752	rundll32.exe	96
PID 4244 wrote to memory of 4064	4244	rundll32.exe	97
PID 4244 wrote to memory of 4064	4244	rundll32.exe	97
PID 4244 wrote to memory of 4064	4244	rundll32.exe	97
PID 4064 wrote to memory of 4876	4064	rundll32.exe	98
PID 4064 wrote to memory of 4876	4064	rundll32.exe	98
PID 4064 wrote to memory of 4876	4064	rundll32.exe	98
PID 4876 wrote to memory of 760	4876	rundll32.exe	99
PID 4876 wrote to memory of 760	4876	rundll32.exe	99
PID 4876 wrote to memory of 760	4876	rundll32.exe	99
PID 760 wrote to memory of 3980	760	rundll32.exe	100
PID 760 wrote to memory of 3980	760	rundll32.exe	100
PID 760 wrote to memory of 3980	760	rundll32.exe	100
PID 3980 wrote to memory of 4748	3980	rundll32.exe	101
PID 3980 wrote to memory of 4748	3980	rundll32.exe	101
PID 3980 wrote to memory of 4748	3980	rundll32.exe	101
PID 4748 wrote to memory of 3100	4748	rundll32.exe	102
PID 4748 wrote to memory of 3100	4748	rundll32.exe	102
PID 4748 wrote to memory of 3100	4748	rundll32.exe	102
PID 3100 wrote to memory of 3724	3100	rundll32.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:512
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        18⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        23⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        24⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        25⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        26⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        27⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        28⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        29⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        30⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        31⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        32⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        33⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        34⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        35⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        36⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        37⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        38⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        39⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        40⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        41⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        42⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        43⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        44⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        45⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        46⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        48⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        49⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        50⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        51⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        52⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        53⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        54⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        55⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        56⤵
        
        PID:536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        57⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        58⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        59⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        60⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        61⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        62⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        63⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        64⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        65⤵
        
        PID:532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        66⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        67⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        68⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        69⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        70⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        71⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        72⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        73⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        74⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        75⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        76⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        77⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        79⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        81⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        82⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        83⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        84⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        85⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        86⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        87⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        89⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        90⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        91⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        92⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        94⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        95⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        96⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        97⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        98⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        99⤵
        
        PID:556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        101⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        102⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        103⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        104⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        105⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        106⤵
        
        PID:208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        108⤵
        
        PID:436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        109⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        110⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        111⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        112⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        113⤵
        
        PID:244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        114⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        115⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        117⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        118⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        119⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        120⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        121⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        123⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        124⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        125⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        126⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        127⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        129⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        130⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        131⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        132⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        133⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        134⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        135⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        137⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        138⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        139⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        140⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        141⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        142⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        143⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        144⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        145⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        146⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        147⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        148⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        149⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        150⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        151⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        152⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        153⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        154⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        155⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        156⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        158⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        159⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        160⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        161⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        162⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        163⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        164⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        165⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        166⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        167⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        168⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        169⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        170⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        171⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        172⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        173⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        174⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        175⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        176⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        177⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        178⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        179⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        180⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        181⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        182⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        184⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        185⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        186⤵
        
        PID:860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        188⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        189⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        190⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        191⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        192⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        193⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        194⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        195⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        196⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        197⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        198⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        200⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        201⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        202⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        203⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        204⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        205⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        206⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        207⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        208⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        209⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        210⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        212⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        213⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        214⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        215⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        216⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        217⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        218⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        219⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        220⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        221⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        222⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        223⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        224⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        225⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        226⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        227⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        228⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        229⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        230⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        231⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        232⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        233⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        234⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        235⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        236⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        237⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        238⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        240⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        241⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        242⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        243⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        244⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        245⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        246⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        248⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        249⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        250⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        251⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        252⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        253⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        254⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        256⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        257⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        258⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        259⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        260⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        261⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        262⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        263⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        264⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        265⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        266⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        267⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        268⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        269⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        270⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        271⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        272⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        273⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        274⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        275⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:7284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        278⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        280⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        281⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        282⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        283⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        285⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        286⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        287⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        288⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        290⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        291⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        292⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        293⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        294⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        295⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        296⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        297⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        298⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        299⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        300⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        301⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        302⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        303⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:7720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        305⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        306⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        307⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        308⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        309⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        310⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        311⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        312⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        313⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        314⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        315⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        316⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        317⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        318⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        319⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        320⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        321⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        322⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        323⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        324⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        325⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        326⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        327⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        328⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        329⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        330⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        331⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        332⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        333⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        334⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        335⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        336⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        337⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        338⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        339⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        340⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        341⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        342⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        343⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        344⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        345⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        346⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        347⤵
        System Location Discovery: System Language Discovery
        
        PID:8332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        348⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        350⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        351⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        352⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        354⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        355⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        357⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        358⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        359⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        360⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        361⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        362⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        363⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        364⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        365⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        366⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        367⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        368⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        369⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        370⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        371⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        373⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        374⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        375⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        376⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:8832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        378⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        379⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        380⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        381⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        382⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        383⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        384⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        385⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        386⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        387⤵
        System Location Discovery: System Language Discovery
        
        PID:8984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        388⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        389⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        390⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        391⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        392⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        393⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        394⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        395⤵
        System Location Discovery: System Language Discovery
        
        PID:9116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        396⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        397⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        398⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        399⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        400⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        401⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        402⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        403⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        404⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        405⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        406⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        407⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        408⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        409⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        410⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        411⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        412⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        413⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        414⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        415⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        416⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        417⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        418⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        419⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        420⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        421⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        422⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        423⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        424⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        425⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        426⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        427⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        428⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        429⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:9840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        431⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        432⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        433⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        434⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        435⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        436⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        437⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        438⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        439⤵
        System Location Discovery: System Language Discovery
        
        PID:9956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        440⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        441⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        442⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        443⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        444⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        445⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        446⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        447⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        448⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        449⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        450⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        451⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        452⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        453⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        454⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        455⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        456⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        457⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        458⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        459⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        460⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        461⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        462⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        463⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        464⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        465⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        466⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        467⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        468⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        469⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        470⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        471⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        472⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        473⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        474⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        475⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        476⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        477⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        478⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        479⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:10568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        481⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        482⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        483⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        484⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        485⤵
        System Location Discovery: System Language Discovery
        
        PID:10648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        486⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        487⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        488⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        489⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        490⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        491⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        492⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        493⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        494⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        495⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        496⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        497⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        498⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        499⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        500⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        501⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        502⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        503⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        504⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        505⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        506⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        507⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        508⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        509⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        510⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        511⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        512⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        513⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        514⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        515⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        516⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        517⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        518⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        519⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        520⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        521⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        522⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        523⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        524⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        525⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        526⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        527⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        528⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        529⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        530⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        531⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        532⤵
        System Location Discovery: System Language Discovery
        
        PID:11356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        533⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        534⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        535⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        536⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        537⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        538⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        539⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        540⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        541⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        542⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        543⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        544⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        545⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        546⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        547⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        548⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        549⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        550⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        551⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        552⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        553⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        554⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        555⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        556⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        557⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        558⤵
        System Location Discovery: System Language Discovery
        
        PID:11796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        559⤵
        System Location Discovery: System Language Discovery
        
        PID:11812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        560⤵
        System Location Discovery: System Language Discovery
        
        PID:11824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        561⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        562⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        563⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        564⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        565⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        566⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        567⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        568⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        569⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        570⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        571⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        572⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        573⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        574⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        575⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        576⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        577⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        578⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        579⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        580⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        581⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        582⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        583⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        584⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        585⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        586⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        587⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        588⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        589⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        590⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        591⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        592⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        593⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        594⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        595⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        596⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        597⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        598⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        599⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        600⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        601⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        602⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        603⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        604⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        605⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        606⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        607⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        608⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        609⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        610⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        611⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        612⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        613⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        614⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        615⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        616⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        617⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        618⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        619⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        620⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        621⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        622⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        623⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        624⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        625⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        626⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        627⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        628⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        629⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        630⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        631⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        632⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        633⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        634⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        635⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        636⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        637⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        638⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        639⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        640⤵
        System Location Discovery: System Language Discovery
        
        PID:13036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        641⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        642⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        643⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        644⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        645⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        646⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        647⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        648⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        649⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        650⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        651⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        652⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        653⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        654⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        655⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        656⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        657⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        658⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        659⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        660⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        661⤵
        
        PID:13416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        662⤵
        System Location Discovery: System Language Discovery
        
        PID:13428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        663⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        664⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        665⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        666⤵
        System Location Discovery: System Language Discovery
        
        PID:13540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        667⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        668⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        669⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        670⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        671⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        672⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        673⤵
        
        PID:13672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        674⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        675⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        676⤵
        
        PID:13720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        677⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        678⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        679⤵
        
        PID:13768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        680⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        681⤵
        System Location Discovery: System Language Discovery
        
        PID:13792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        682⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        683⤵
        
        PID:13824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        684⤵
        
        PID:13840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        685⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        686⤵
        System Location Discovery: System Language Discovery
        
        PID:13872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        687⤵
        
        PID:13884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        688⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        689⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        690⤵
        
        PID:13936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        691⤵
        System Location Discovery: System Language Discovery
        
        PID:13952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        692⤵
        
        PID:13968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        693⤵
        
        PID:13984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        694⤵
        System Location Discovery: System Language Discovery
        
        PID:14000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        695⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        696⤵
        
        PID:14032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        697⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        698⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        699⤵
        
        PID:14080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        700⤵
        
        PID:14096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        701⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        702⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        703⤵
        
        PID:14148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        704⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        705⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        706⤵
        
        PID:14192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        707⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        708⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        709⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        710⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        711⤵
        
        PID:14268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        712⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        713⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        714⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        715⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        716⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        717⤵
        
        PID:14352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        718⤵
        
        PID:14368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        719⤵
        
        PID:14384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        720⤵
        
        PID:14400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        721⤵
        
        PID:14416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        722⤵
        
        PID:14432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        723⤵
        
        PID:14448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        724⤵
        
        PID:14460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        725⤵
        
        PID:14480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        726⤵
        
        PID:14496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        727⤵
        
        PID:14512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        728⤵
        
        PID:14528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        729⤵
        
        PID:14544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        730⤵
        
        PID:14560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        731⤵
        
        PID:14576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        732⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        733⤵
        
        PID:14608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        734⤵
        
        PID:14624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        735⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        736⤵
        
        PID:14656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        737⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        738⤵
        
        PID:14688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        739⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        740⤵
        
        PID:14720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        741⤵
        System Location Discovery: System Language Discovery
        
        PID:14736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        742⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        743⤵
        
        PID:14764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        744⤵
        
        PID:14780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        745⤵
        
        PID:14796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        746⤵
        
        PID:14808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        747⤵
        
        PID:14824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        748⤵
        
        PID:14840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        749⤵
        
        PID:14856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        750⤵
        
        PID:14872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        751⤵
        
        PID:14892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        752⤵
        
        PID:14908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        753⤵
        
        PID:14924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        754⤵
        
        PID:14940
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        755⤵
        
        PID:14952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        756⤵
        
        PID:14968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        757⤵
        
        PID:14984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        758⤵
        
        PID:15000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        759⤵
        
        PID:15016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        760⤵
        
        PID:15028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        761⤵
        
        PID:15048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        762⤵
        System Location Discovery: System Language Discovery
        
        PID:15064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        763⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        764⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        765⤵
        
        PID:15112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        766⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        767⤵
        
        PID:15140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        768⤵
        
        PID:15156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        769⤵
        
        PID:15172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        770⤵
        
        PID:15184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        771⤵
        
        PID:15200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        772⤵
        
        PID:15216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        773⤵
        
        PID:15232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        774⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        775⤵
        
        PID:15264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        776⤵
        
        PID:15280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        777⤵
        
        PID:15296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        778⤵
        
        PID:15312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        779⤵
        
        PID:15328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        780⤵
        
        PID:15344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        781⤵
        
        PID:15356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        782⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        783⤵
        
        PID:15380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        784⤵
        
        PID:15396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        785⤵
        
        PID:15416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        786⤵
        
        PID:15436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        787⤵
        
        PID:15448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        788⤵
        
        PID:15464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        789⤵
        
        PID:15480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        790⤵
        
        PID:15496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        791⤵
        
        PID:15516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        792⤵
        
        PID:15532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        793⤵
        System Location Discovery: System Language Discovery
        
        PID:15548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        794⤵
        
        PID:15560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        795⤵
        
        PID:15576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        796⤵
        
        PID:15592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        797⤵
        
        PID:15608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        798⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        799⤵
        
        PID:15652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        800⤵
        
        PID:15688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        801⤵
        
        PID:15704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        802⤵
        
        PID:15720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        803⤵
        
        PID:15736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        804⤵
        
        PID:15756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        805⤵
        
        PID:15772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        806⤵
        
        PID:15792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        807⤵
        
        PID:15812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        808⤵
        
        PID:15832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        809⤵
        
        PID:15852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        810⤵
        
        PID:15868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        811⤵
        
        PID:15880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        812⤵
        
        PID:15896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        813⤵
        
        PID:15912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        814⤵
        
        PID:15928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        815⤵
        
        PID:15948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        816⤵
        
        PID:15964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        817⤵
        
        PID:15988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        818⤵
        
        PID:16004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        819⤵
        
        PID:16020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        820⤵
        
        PID:16036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        821⤵
        
        PID:16048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        822⤵
        
        PID:16064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        823⤵
        System Location Discovery: System Language Discovery
        
        PID:16080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        824⤵
        
        PID:16092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        825⤵
        
        PID:16112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        826⤵
        
        PID:16124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        827⤵
        
        PID:16140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        828⤵
        
        PID:16160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        829⤵
        
        PID:16172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        830⤵
        
        PID:16184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        831⤵
        
        PID:16196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        832⤵
        
        PID:16216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        833⤵
        
        PID:16232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        834⤵
        
        PID:16244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        835⤵
        
        PID:16256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        836⤵
        System Location Discovery: System Language Discovery
        
        PID:16268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        837⤵
        System Location Discovery: System Language Discovery
        
        PID:16284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        838⤵
        
        PID:16296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        839⤵
        
        PID:16312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        840⤵
        
        PID:16324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        841⤵
        
        PID:16340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        842⤵
        
        PID:16356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        843⤵
        
        PID:16372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        844⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        845⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        846⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        847⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        848⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        849⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        850⤵
        
        PID:15784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        851⤵
        
        PID:16400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        852⤵
        
        PID:16416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        853⤵
        
        PID:16428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        854⤵
        
        PID:16440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        855⤵
        
        PID:16452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        856⤵
        
        PID:16468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        857⤵
        
        PID:16480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        858⤵
        System Location Discovery: System Language Discovery
        
        PID:16492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        859⤵
        
        PID:16508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        860⤵
        
        PID:16524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        861⤵
        System Location Discovery: System Language Discovery
        
        PID:16540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        862⤵
        
        PID:16556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        863⤵
        
        PID:16568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        864⤵
        
        PID:16584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        865⤵
        
        PID:16600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        866⤵
        
        PID:16616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        867⤵
        
        PID:16632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        868⤵
        
        PID:16648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        869⤵
        
        PID:16660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        870⤵
        
        PID:16676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        871⤵
        
        PID:16692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        872⤵
        
        PID:16708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        873⤵
        System Location Discovery: System Language Discovery
        
        PID:16724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        874⤵
        
        PID:16740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        875⤵
        
        PID:16756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        876⤵
        
        PID:16772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        877⤵
        
        PID:16788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        878⤵
        
        PID:16804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        879⤵
        System Location Discovery: System Language Discovery
        
        PID:16816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        880⤵
        
        PID:16832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        881⤵
        
        PID:16848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        882⤵
        
        PID:16864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        883⤵
        
        PID:16876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        884⤵
        
        PID:16892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        885⤵
        
        PID:16908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        886⤵
        
        PID:16924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\147b7692775c4628221838fd5bf0972a_JaffaCakes118.dll,#1
        887⤵
        
        PID:16940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/16876-2-0x0000000074FD0000-0x0000000075254000-memory.dmp

Filesize
2.5MB

Download
memory/16892-1-0x0000000074FD0000-0x0000000075254000-memory.dmp

Filesize
2.5MB

Download
memory/16908-0-0x0000000074FD0000-0x0000000075254000-memory.dmp

Filesize
2.5MB

Download