Analysis
-
max time kernel
149s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe
-
Size
176KB
-
MD5
0c3d3e8464ffbe289ecf15a685c1c76f
-
SHA1
73c2f5c2ba426c5eef7ec91e9cd98973ad25f1f4
-
SHA256
f19e6d3dcdea80b9a05e67b296e37ffa59cc4081e9789290f490e4175166c1fc
-
SHA512
cd81a5d016d8c4f8a50c8279dc9a02311c2116bc22e3b7edde9933e7152ae060278b1aeb517995615bcc40ceb8e0ba0db34547b0eec7fe13555dc75a9aaed686
-
SSDEEP
3072:sWIKLnOesPIqaGqqCG6K3StodupRARFlXNARpSTdBwRlV4qxH:sYOe4IqaGqqCG6K3SuduLARFl9ARpS02
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4392 moo2.exe 2724 moo2.exe 2220 moo2.exe 5004 moo2.exe 436 moo2.exe 5052 moo2.exe 4880 moo2.exe 1472 moo2.exe 1936 moo2.exe 4660 moo2.exe 5036 moo2.exe 3916 moo2.exe 3168 moo2.exe 2932 moo2.exe 1356 moo2.exe 1664 moo2.exe 4960 moo2.exe 4652 moo2.exe 4940 moo2.exe 4548 moo2.exe 3872 moo2.exe 3656 moo2.exe 3668 moo2.exe 4136 moo2.exe 388 moo2.exe 4520 moo2.exe 3016 moo2.exe 3256 moo2.exe 4864 moo2.exe 2760 moo2.exe 4788 moo2.exe 1864 moo2.exe 3224 moo2.exe 772 moo2.exe 924 moo2.exe 4396 moo2.exe 4872 moo2.exe 3260 moo2.exe 3532 moo2.exe 4324 moo2.exe 784 moo2.exe 5088 moo2.exe 3936 moo2.exe 2380 moo2.exe 3212 moo2.exe 4996 moo2.exe 4440 moo2.exe 2188 moo2.exe 4352 moo2.exe 4992 moo2.exe 3420 moo2.exe 2744 moo2.exe 4144 moo2.exe 1704 moo2.exe 5112 moo2.exe 3568 moo2.exe 4120 moo2.exe 4584 moo2.exe 2364 moo2.exe 2212 moo2.exe 656 moo2.exe 3676 moo2.exe 4976 moo2.exe 3200 moo2.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 752 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 4392 moo2.exe 2724 moo2.exe 2220 moo2.exe 5004 moo2.exe 436 moo2.exe 5052 moo2.exe 4880 moo2.exe 1472 moo2.exe 1936 moo2.exe 4660 moo2.exe 5036 moo2.exe 3916 moo2.exe 3168 moo2.exe 2932 moo2.exe 1356 moo2.exe 1664 moo2.exe 4960 moo2.exe 4652 moo2.exe 4940 moo2.exe 4548 moo2.exe 3872 moo2.exe 3656 moo2.exe 3668 moo2.exe 4136 moo2.exe 388 moo2.exe 4520 moo2.exe 3016 moo2.exe 3256 moo2.exe 4864 moo2.exe 2760 moo2.exe 4788 moo2.exe 1864 moo2.exe 3224 moo2.exe 772 moo2.exe 924 moo2.exe 4396 moo2.exe 4872 moo2.exe 3260 moo2.exe 3532 moo2.exe 4324 moo2.exe 784 moo2.exe 5088 moo2.exe 3936 moo2.exe 2380 moo2.exe 3212 moo2.exe 4996 moo2.exe 4440 moo2.exe 4352 moo2.exe 4992 moo2.exe 3420 moo2.exe 2744 moo2.exe 4144 moo2.exe 1704 moo2.exe 5112 moo2.exe 3568 moo2.exe 4120 moo2.exe 4584 moo2.exe 2364 moo2.exe 2212 moo2.exe 656 moo2.exe 3676 moo2.exe 4976 moo2.exe 3200 moo2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 752 wrote to memory of 4392 752 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 83 PID 752 wrote to memory of 4392 752 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 83 PID 752 wrote to memory of 4392 752 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 83 PID 4392 wrote to memory of 2724 4392 moo2.exe 84 PID 4392 wrote to memory of 2724 4392 moo2.exe 84 PID 4392 wrote to memory of 2724 4392 moo2.exe 84 PID 2724 wrote to memory of 2220 2724 moo2.exe 85 PID 2724 wrote to memory of 2220 2724 moo2.exe 85 PID 2724 wrote to memory of 2220 2724 moo2.exe 85 PID 2220 wrote to memory of 5004 2220 moo2.exe 86 PID 2220 wrote to memory of 5004 2220 moo2.exe 86 PID 2220 wrote to memory of 5004 2220 moo2.exe 86 PID 5004 wrote to memory of 436 5004 moo2.exe 87 PID 5004 wrote to memory of 436 5004 moo2.exe 87 PID 5004 wrote to memory of 436 5004 moo2.exe 87 PID 436 wrote to memory of 5052 436 moo2.exe 88 PID 436 wrote to memory of 5052 436 moo2.exe 88 PID 436 wrote to memory of 5052 436 moo2.exe 88 PID 5052 wrote to memory of 4880 5052 moo2.exe 89 PID 5052 wrote to memory of 4880 5052 moo2.exe 89 PID 5052 wrote to memory of 4880 5052 moo2.exe 89 PID 4880 wrote to memory of 1472 4880 moo2.exe 90 PID 4880 wrote to memory of 1472 4880 moo2.exe 90 PID 4880 wrote to memory of 1472 4880 moo2.exe 90 PID 1472 wrote to memory of 1936 1472 moo2.exe 91 PID 1472 wrote to memory of 1936 1472 moo2.exe 91 PID 1472 wrote to memory of 1936 1472 moo2.exe 91 PID 1936 wrote to memory of 4660 1936 moo2.exe 92 PID 1936 wrote to memory of 4660 1936 moo2.exe 92 PID 1936 wrote to memory of 4660 1936 moo2.exe 92 PID 4660 wrote to memory of 5036 4660 moo2.exe 93 PID 4660 wrote to memory of 5036 4660 moo2.exe 93 PID 4660 wrote to memory of 5036 4660 moo2.exe 93 PID 5036 wrote to memory of 3916 5036 moo2.exe 94 PID 5036 wrote to memory of 3916 5036 moo2.exe 94 PID 5036 wrote to memory of 3916 5036 moo2.exe 94 PID 3916 wrote to memory of 3168 3916 moo2.exe 95 PID 3916 wrote to memory of 3168 3916 moo2.exe 95 PID 3916 wrote to memory of 3168 3916 moo2.exe 95 PID 3168 wrote to memory of 2932 3168 moo2.exe 96 PID 3168 wrote to memory of 2932 3168 moo2.exe 96 PID 3168 wrote to memory of 2932 3168 moo2.exe 96 PID 2932 wrote to memory of 1356 2932 moo2.exe 97 PID 2932 wrote to memory of 1356 2932 moo2.exe 97 PID 2932 wrote to memory of 1356 2932 moo2.exe 97 PID 1356 wrote to memory of 1664 1356 moo2.exe 99 PID 1356 wrote to memory of 1664 1356 moo2.exe 99 PID 1356 wrote to memory of 1664 1356 moo2.exe 99 PID 1664 wrote to memory of 4960 1664 moo2.exe 100 PID 1664 wrote to memory of 4960 1664 moo2.exe 100 PID 1664 wrote to memory of 4960 1664 moo2.exe 100 PID 4960 wrote to memory of 4652 4960 moo2.exe 101 PID 4960 wrote to memory of 4652 4960 moo2.exe 101 PID 4960 wrote to memory of 4652 4960 moo2.exe 101 PID 4652 wrote to memory of 4940 4652 moo2.exe 102 PID 4652 wrote to memory of 4940 4652 moo2.exe 102 PID 4652 wrote to memory of 4940 4652 moo2.exe 102 PID 4940 wrote to memory of 4548 4940 moo2.exe 103 PID 4940 wrote to memory of 4548 4940 moo2.exe 103 PID 4940 wrote to memory of 4548 4940 moo2.exe 103 PID 4548 wrote to memory of 3872 4548 moo2.exe 105 PID 4548 wrote to memory of 3872 4548 moo2.exe 105 PID 4548 wrote to memory of 3872 4548 moo2.exe 105 PID 3872 wrote to memory of 3656 3872 moo2.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 110⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 111⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 112⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 113⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 114⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 115⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 116⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 117⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 118⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 119⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 120⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 121⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 122⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 123⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 124⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 125⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 126⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:388 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 127⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 128⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 129⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 130⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 131⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 132⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 133⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 134⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 135⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:772 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 136⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 137⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 138⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 139⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 140⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 141⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 142⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 143⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 144⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 145⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 146⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 147⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 148⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 149⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 150⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 151⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 152⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 153⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 154⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 155⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 156⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 157⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 158⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 159⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 160⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 161⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 162⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:656 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 163⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 164⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 165⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 166⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 167⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 168⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 169⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 170⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 171⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 172⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 173⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 174⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 175⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 176⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 177⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 178⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 179⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 180⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 181⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 182⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 183⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 184⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 185⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 186⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 187⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 188⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 189⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 190⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 191⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 192⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 193⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 194⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 195⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 196⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 197⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 198⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 199⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1100⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1101⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1102⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1103⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1104⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1105⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1106⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1107⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1108⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1109⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1110⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1111⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1112⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1113⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1114⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1115⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1116⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1117⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1118⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1119⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1120⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1121⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1122⤵PID:5176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-