Analysis
-
max time kernel
85s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-11-2020 14:13
Static task
static1
Behavioral task
behavioral1
Sample
1qj5u.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
1qj5u.exe
-
Size
112KB
-
MD5
c989356bdc4ffc9b4752acecfddb551d
-
SHA1
fff0e011c492e174a3175c3ddb2ee0d6ed9d7285
-
SHA256
8afc2dd7267bbf83a46549f4e7731f6473610c33bc9ee41b4dd0b994c3a29473
-
SHA512
f51769eed207b7b0e9387c9bc13d46502f0c25086c6f1ce8d16678bbe639f06efb799959efac10aefd6d92dd08310216d2929178ebee3f2c73ecad286c89da1f
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://etasuklavish.today/
http://mragyzmachnobesdi.today/
http://kimchinikuzims.today/
http://slacvostinrius.today/
http://straponuliusyn.today/
http://grammmdinss.today/
http://viprasputinsd.chimkent.su/
http://lupadypa.dagestan.su/
http://stoknolimchin.exnet.su/
http://musaroprovadnikov.live/
http://teemforyourexprensiti.life/
http://stolkgolmishutich.termez.su/
http://roompampamgandish.wtf/
rc4.i32
rc4.i32
Extracted
Family
zloader
Botnet
r1
Campaign
r1
C2
https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
rc4.plain
rsa_pubkey.plain
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
pid Process 2600 95EC.tmp.exe 940 97A3.tmp.exe -
Deletes itself 1 IoCs
pid Process 2092 Process not Found -
Loads dropped DLL 1 IoCs
pid Process 744 1qj5u.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1qj5u.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1qj5u.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1qj5u.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F25BBC33-2E5F-11EB-BEBD-EAF55770C779} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d0000000002000000000010660000000100002000000037eebcef4aead0c5294b0122e7fa82b6e8175d4856ed4da332822046d99c815c000000000e800000000200002000000087a64a10ceb13042f5304d8dbf5f68f314657e28078ce7e921c197e860b49aa72000000024badabfc7eddf9a8b0b1dc444a1cce55581bda2f79b0435e553c2e716068f0e4000000071339e64387b115a8c8eeb070f9b6ac84594342f167561220c9e7b90c564ed55292275378efec6c0d0943f7f2727ad8b180c80f7f1e2773ca6f1053c93442a24 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2916381004" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30851692" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000007c91b4890f817fcc8058b250a5202592cc4d15999e0ae88c665d2ae208164f53000000000e800000000200002000000028a0783b9d99253f0bec240a77038e539b8fac80c3b282af2f987e438e082c2720000000f4f68668e68952222cfaa64604532cba5f2257983b4e74e6f95c27ff55c2f15840000000ff7df52a5b2eac1ecf03d27d1ddaabb8b8e7d1b3033387e72abd33bb7d76b835b04c4cba65497a9c6c173e29599dbf27248b2bbf4e9d5371b32e5990e130f648 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00626fae6cc2d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30851692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000d4216f6a1efb304ca525bc2d780f4278f3d5284d521c8095c9d0908baa0cb094000000000e800000000200002000000002512b7adb5bc6e226199f0a999cf2a8313b8ce8ce6f3a02c4a6fdbbf0b47879200000003fdd67df389de1bda1d7da537a50cc318980c066ffde5c1567d537a9242d8a21400000008ad0ed66182076da5e41dcc2a0509d2be138f9da9420d56b901cc78c00e320d1590b1138d785e8cc050bfa9cf221f4d7bff20d6aee8c01e528be09138bd3316e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0487bae6cc2d601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05b39b56cc2d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9425ADA-2E5F-11EB-BEBD-EAF55770C779} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2916381004" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1364 IoCs
pid Process 744 1qj5u.exe 744 1qj5u.exe 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found 2092 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2092 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 744 1qj5u.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found Token: SeShutdownPrivilege 2092 Process not Found Token: SeCreatePagefilePrivilege 2092 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4064 iexplore.exe 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4064 iexplore.exe 4064 iexplore.exe 3196 IEXPLORE.EXE 3196 IEXPLORE.EXE 2468 iexplore.exe 2468 iexplore.exe 776 IEXPLORE.EXE 776 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2092 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2600 2092 Process not Found 79 PID 2092 wrote to memory of 2600 2092 Process not Found 79 PID 2092 wrote to memory of 2600 2092 Process not Found 79 PID 2092 wrote to memory of 940 2092 Process not Found 80 PID 2092 wrote to memory of 940 2092 Process not Found 80 PID 2092 wrote to memory of 940 2092 Process not Found 80 PID 4064 wrote to memory of 3196 4064 iexplore.exe 83 PID 4064 wrote to memory of 3196 4064 iexplore.exe 83 PID 4064 wrote to memory of 3196 4064 iexplore.exe 83 PID 2468 wrote to memory of 776 2468 iexplore.exe 85 PID 2468 wrote to memory of 776 2468 iexplore.exe 85 PID 2468 wrote to memory of 776 2468 iexplore.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1qj5u.exe"C:\Users\Admin\AppData\Local\Temp\1qj5u.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:744
-
C:\Users\Admin\AppData\Local\Temp\95EC.tmp.exeC:\Users\Admin\AppData\Local\Temp\95EC.tmp.exe1⤵
- Executes dropped EXE
PID:2600
-
C:\Users\Admin\AppData\Local\Temp\97A3.tmp.exeC:\Users\Admin\AppData\Local\Temp\97A3.tmp.exe1⤵
- Executes dropped EXE
PID:940
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4064 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3196
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:776
-