Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe
-
Size
176KB
-
MD5
0c3d3e8464ffbe289ecf15a685c1c76f
-
SHA1
73c2f5c2ba426c5eef7ec91e9cd98973ad25f1f4
-
SHA256
f19e6d3dcdea80b9a05e67b296e37ffa59cc4081e9789290f490e4175166c1fc
-
SHA512
cd81a5d016d8c4f8a50c8279dc9a02311c2116bc22e3b7edde9933e7152ae060278b1aeb517995615bcc40ceb8e0ba0db34547b0eec7fe13555dc75a9aaed686
-
SSDEEP
3072:sWIKLnOesPIqaGqqCG6K3StodupRARFlXNARpSTdBwRlV4qxH:sYOe4IqaGqqCG6K3SuduLARFl9ARpS02
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3008 moo2.exe 1220 moo2.exe 1332 moo2.exe 2780 moo2.exe 3060 moo2.exe 2644 moo2.exe 2712 moo2.exe 2696 moo2.exe 2820 moo2.exe 2772 moo2.exe 2532 moo2.exe 2524 moo2.exe 2664 moo2.exe 1376 moo2.exe 2508 moo2.exe 2572 moo2.exe 2900 moo2.exe 1268 moo2.exe 2196 moo2.exe 1792 moo2.exe 1940 moo2.exe 1968 moo2.exe 2224 moo2.exe 2472 moo2.exe 1444 moo2.exe 2408 moo2.exe 2412 moo2.exe 2436 moo2.exe 2460 moo2.exe 1720 moo2.exe 772 moo2.exe 1088 moo2.exe 284 moo2.exe 1272 moo2.exe 572 moo2.exe 1196 moo2.exe 1572 moo2.exe 1624 moo2.exe 1604 moo2.exe 1484 moo2.exe 1608 moo2.exe 656 moo2.exe 1696 moo2.exe 296 moo2.exe 2376 moo2.exe 1136 moo2.exe 2336 moo2.exe 1180 moo2.exe 2800 moo2.exe 2372 moo2.exe 2840 moo2.exe 1780 moo2.exe 1124 moo2.exe 832 moo2.exe 444 moo2.exe 2960 moo2.exe 2844 moo2.exe 696 moo2.exe 780 moo2.exe 1672 moo2.exe 1540 moo2.exe 1824 moo2.exe 1372 moo2.exe 2032 moo2.exe -
Loads dropped DLL 64 IoCs
pid Process 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 3008 moo2.exe 1220 moo2.exe 1332 moo2.exe 2780 moo2.exe 3060 moo2.exe 2644 moo2.exe 2712 moo2.exe 2696 moo2.exe 2820 moo2.exe 2772 moo2.exe 2532 moo2.exe 2524 moo2.exe 2664 moo2.exe 1376 moo2.exe 2508 moo2.exe 2572 moo2.exe 2900 moo2.exe 1268 moo2.exe 2196 moo2.exe 1792 moo2.exe 1940 moo2.exe 1968 moo2.exe 2224 moo2.exe 2472 moo2.exe 1444 moo2.exe 2408 moo2.exe 2412 moo2.exe 2436 moo2.exe 2460 moo2.exe 1720 moo2.exe 772 moo2.exe 1088 moo2.exe 284 moo2.exe 1272 moo2.exe 572 moo2.exe 1196 moo2.exe 1572 moo2.exe 1624 moo2.exe 1604 moo2.exe 1484 moo2.exe 1608 moo2.exe 656 moo2.exe 1696 moo2.exe 296 moo2.exe 2376 moo2.exe 1136 moo2.exe 2336 moo2.exe 1180 moo2.exe 2800 moo2.exe 2372 moo2.exe 2840 moo2.exe 1780 moo2.exe 1124 moo2.exe 832 moo2.exe 444 moo2.exe 2960 moo2.exe 2844 moo2.exe 696 moo2.exe 780 moo2.exe 1672 moo2.exe 1540 moo2.exe 1824 moo2.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 3008 moo2.exe 1220 moo2.exe 1332 moo2.exe 2780 moo2.exe 3060 moo2.exe 2644 moo2.exe 2712 moo2.exe 2696 moo2.exe 2820 moo2.exe 2772 moo2.exe 2532 moo2.exe 2524 moo2.exe 2664 moo2.exe 1376 moo2.exe 2508 moo2.exe 2572 moo2.exe 2900 moo2.exe 1268 moo2.exe 2196 moo2.exe 1792 moo2.exe 1940 moo2.exe 1968 moo2.exe 2224 moo2.exe 2472 moo2.exe 1444 moo2.exe 2408 moo2.exe 2412 moo2.exe 2436 moo2.exe 2460 moo2.exe 1720 moo2.exe 772 moo2.exe 1088 moo2.exe 284 moo2.exe 1272 moo2.exe 572 moo2.exe 1196 moo2.exe 1572 moo2.exe 1624 moo2.exe 1604 moo2.exe 1484 moo2.exe 1608 moo2.exe 656 moo2.exe 1696 moo2.exe 296 moo2.exe 2376 moo2.exe 1136 moo2.exe 2336 moo2.exe 1180 moo2.exe 2800 moo2.exe 2372 moo2.exe 2840 moo2.exe 1780 moo2.exe 1124 moo2.exe 832 moo2.exe 444 moo2.exe 2960 moo2.exe 2844 moo2.exe 696 moo2.exe 780 moo2.exe 1672 moo2.exe 1540 moo2.exe 1824 moo2.exe 1372 moo2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1192 wrote to memory of 3008 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 28 PID 1192 wrote to memory of 3008 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 28 PID 1192 wrote to memory of 3008 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 28 PID 1192 wrote to memory of 3008 1192 0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe 28 PID 3008 wrote to memory of 1220 3008 moo2.exe 29 PID 3008 wrote to memory of 1220 3008 moo2.exe 29 PID 3008 wrote to memory of 1220 3008 moo2.exe 29 PID 3008 wrote to memory of 1220 3008 moo2.exe 29 PID 1220 wrote to memory of 1332 1220 moo2.exe 30 PID 1220 wrote to memory of 1332 1220 moo2.exe 30 PID 1220 wrote to memory of 1332 1220 moo2.exe 30 PID 1220 wrote to memory of 1332 1220 moo2.exe 30 PID 1332 wrote to memory of 2780 1332 moo2.exe 31 PID 1332 wrote to memory of 2780 1332 moo2.exe 31 PID 1332 wrote to memory of 2780 1332 moo2.exe 31 PID 1332 wrote to memory of 2780 1332 moo2.exe 31 PID 2780 wrote to memory of 3060 2780 moo2.exe 32 PID 2780 wrote to memory of 3060 2780 moo2.exe 32 PID 2780 wrote to memory of 3060 2780 moo2.exe 32 PID 2780 wrote to memory of 3060 2780 moo2.exe 32 PID 3060 wrote to memory of 2644 3060 moo2.exe 33 PID 3060 wrote to memory of 2644 3060 moo2.exe 33 PID 3060 wrote to memory of 2644 3060 moo2.exe 33 PID 3060 wrote to memory of 2644 3060 moo2.exe 33 PID 2644 wrote to memory of 2712 2644 moo2.exe 34 PID 2644 wrote to memory of 2712 2644 moo2.exe 34 PID 2644 wrote to memory of 2712 2644 moo2.exe 34 PID 2644 wrote to memory of 2712 2644 moo2.exe 34 PID 2712 wrote to memory of 2696 2712 moo2.exe 35 PID 2712 wrote to memory of 2696 2712 moo2.exe 35 PID 2712 wrote to memory of 2696 2712 moo2.exe 35 PID 2712 wrote to memory of 2696 2712 moo2.exe 35 PID 2696 wrote to memory of 2820 2696 moo2.exe 36 PID 2696 wrote to memory of 2820 2696 moo2.exe 36 PID 2696 wrote to memory of 2820 2696 moo2.exe 36 PID 2696 wrote to memory of 2820 2696 moo2.exe 36 PID 2820 wrote to memory of 2772 2820 moo2.exe 37 PID 2820 wrote to memory of 2772 2820 moo2.exe 37 PID 2820 wrote to memory of 2772 2820 moo2.exe 37 PID 2820 wrote to memory of 2772 2820 moo2.exe 37 PID 2772 wrote to memory of 2532 2772 moo2.exe 38 PID 2772 wrote to memory of 2532 2772 moo2.exe 38 PID 2772 wrote to memory of 2532 2772 moo2.exe 38 PID 2772 wrote to memory of 2532 2772 moo2.exe 38 PID 2532 wrote to memory of 2524 2532 moo2.exe 39 PID 2532 wrote to memory of 2524 2532 moo2.exe 39 PID 2532 wrote to memory of 2524 2532 moo2.exe 39 PID 2532 wrote to memory of 2524 2532 moo2.exe 39 PID 2524 wrote to memory of 2664 2524 moo2.exe 40 PID 2524 wrote to memory of 2664 2524 moo2.exe 40 PID 2524 wrote to memory of 2664 2524 moo2.exe 40 PID 2524 wrote to memory of 2664 2524 moo2.exe 40 PID 2664 wrote to memory of 1376 2664 moo2.exe 41 PID 2664 wrote to memory of 1376 2664 moo2.exe 41 PID 2664 wrote to memory of 1376 2664 moo2.exe 41 PID 2664 wrote to memory of 1376 2664 moo2.exe 41 PID 1376 wrote to memory of 2508 1376 moo2.exe 42 PID 1376 wrote to memory of 2508 1376 moo2.exe 42 PID 1376 wrote to memory of 2508 1376 moo2.exe 42 PID 1376 wrote to memory of 2508 1376 moo2.exe 42 PID 2508 wrote to memory of 2572 2508 moo2.exe 43 PID 2508 wrote to memory of 2572 2508 moo2.exe 43 PID 2508 wrote to memory of 2572 2508 moo2.exe 43 PID 2508 wrote to memory of 2572 2508 moo2.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c3d3e8464ffbe289ecf15a685c1c76f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 110⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 111⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 112⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 113⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 114⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 115⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 116⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 117⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 118⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 119⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 120⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 121⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 123⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 124⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 125⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 126⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 127⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 128⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 129⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 130⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 131⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 132⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:772 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 133⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 134⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:284 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 135⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 136⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:572 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 137⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 138⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 139⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 140⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 141⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 142⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 143⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:656 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 144⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 145⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:296 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 146⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 147⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 148⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 149⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 150⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 151⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 152⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 153⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 154⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 155⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:832 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 156⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:444 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 157⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 158⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 159⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:696 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 160⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:780 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 161⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 162⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 163⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 164⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 165⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 166⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 167⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 168⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 169⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 170⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 171⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 172⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 173⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 174⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 175⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 176⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 177⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 178⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 179⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 180⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 181⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 182⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 183⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 184⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 185⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 186⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 187⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 188⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 189⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 190⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 191⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 192⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 193⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 194⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 195⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 196⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 197⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 198⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 199⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1100⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1102⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1103⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1104⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1105⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1106⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1107⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1108⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1109⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1110⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1111⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1112⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1113⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1114⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1115⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1116⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1117⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1118⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1119⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1120⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1121⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\moo2.exemoo2.exe 1122⤵PID:1612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-