Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 05:33
Static task
static1
General
-
Target
528b0a5e035635c64a71c7db288ec18036ae01c6b1be4fb881efcf66480ce82a.exe
-
Size
880KB
-
MD5
118856094161888e73949e8674211b2e
-
SHA1
39c09965d424ccea7088755329fbf17886f05aff
-
SHA256
528b0a5e035635c64a71c7db288ec18036ae01c6b1be4fb881efcf66480ce82a
-
SHA512
3d20861ce7fdba570ad949819396422ab427d98e9e7bc8c26cb8c89e26e0b1cfb0a2aed95437c7ce1402d14df4157c9fc0ce7a8aedee2c82a96b3fea3b3ddd7c
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43F47072-11F9-11EC-A248-6AEBE9E18BEF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000002577476d231fbcc390e6638e87d0829261a91b4ae585bae887bc6d94a132d3ce000000000e800000000200002000000050051e56cb647f5bdcdfa664a646b4bc6dc14fdd69be549353cedf982ad45cd120000000256346c55c664552c23f8f8493bea7b97f5a7d04f0eb6a9e8f0687b04ef56d8d4000000002381e3f83f7228b0ea754fe2f73c4687c8fe217a2ebe8b6003a3a64c35a2bfe50c564caccd8f710893f16395d19630e07705086138da592234ba846bc07fdc2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000002c724e5952ef28edf20b0bdd8f7bc71ae4a279d7bde0f6a2a77bd02ee0f665a2000000000e8000000002000020000000211df5d163c9fb293628be725bab1d97ee501f8e91856643cd188c955f32e65b200000000db68d4e2e6c9ce645b8c52d01f399f362373e58e853f8b43e4ebf4ee6be1880400000003fca4394e591248c24aa7e97bb5025ed8f49b200a9845ae145e5287d2531a6c5f517db0ed361e928154f92fd39bd4325b9de65be5bdd64d13b6bd4c2a984dcef iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000d69ad821eed61a27ff243c4b243aa51eab0e42c4fe593200b54ce59a713a2618000000000e8000000002000020000000cf4a08cdd0ece0480b5125d03ce11a3b158b012944eb3c6f59f3200be5ec0c0820000000ec2bcf986ccf0deb1ecbb7481eac88204e956e6cff29a259b4d093e3179f81864000000017b51698a46b0193decd9fb1f9fe0074f920acba283a9c0d4defff4fe9988bffc1eba22abc5677f28360a5563c4d1a0aea982ab2f26848236a3197bc0201a7d3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EBFC1C9-11F9-11EC-A248-6AEBE9E18BEF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000540e18583530c918339e3ecb3aa9942de244d88c8fcc50c20b0c4ae18429be93000000000e80000000020000200000009faea45232d190b748b32d9ebad971ffae949ea44d607c2c9a64ca079674e6bb2000000057df19e0a6cb729c2b635490ad590c1101643f40c933620db23c2afe7a73874640000000ca7e70461383f918a9752eff92d193bc42b93fe553ab4c5e15a441fb107caa3f4c19cbfbaf1efd27984b54e7a90198e5892527341d8b651756c451f1a6495766 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000003fd4f2f3bafc55e87e9fb0310c9f3028c86153c3bc54985b893cd1392c2fc478000000000e8000000002000020000000c1226814f1a7da61942a561d22a538a4df2004883a7bf12a004cec8d66ebbb6320000000633dd52bf0672a83c127cb1b5e6f1fdec5bb7a6487de0398d4e4666308112869400000002fb1a83038e84edd22a44a2ea3969f7a8a969a491bde7920cb0168251f3c8f2f32b0622450614efcaf4ef35b332ad6f5f9e62202bd6237cf4e11ad659f31d64c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0017a51306a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D01D6C5-11F9-11EC-A248-6AEBE9E18BEF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403e22f805a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000db9d6cabf8c1dc50a6a90f103bcfd24cf26c792cd2869c691f3b83713f19acce000000000e800000000200002000000094fa010626a32ad7332c46dcdfaa2f1aad1036a953f8ee95f4660f77c9f3c0322000000002c07eb365a177f2a8ddb4d584b2c557216de3f33a711553f2c83462285041c440000000d2333c59a36451ac50e6aa6f980352b807b5bb52da0e32d56d643cacd1b5f802c857cb08b9dcb038d95e91b0401cdc075b3623094d34678eaaa9c46ac8e033c4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703fdcf805a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8016bf0606a6d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ee872106a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{361400E6-11F9-11EC-A248-6AEBE9E18BEF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22E9592C-11F9-11EC-A248-6AEBE9E18BEF} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4640 iexplore.exe 864 iexplore.exe 1716 iexplore.exe 1568 iexplore.exe 4696 iexplore.exe 780 iexplore.exe 4904 iexplore.exe 656 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 4640 iexplore.exe 4640 iexplore.exe 516 IEXPLORE.EXE 516 IEXPLORE.EXE 864 iexplore.exe 864 iexplore.exe 1316 IEXPLORE.EXE 1316 IEXPLORE.EXE 1716 iexplore.exe 1716 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 1568 iexplore.exe 1568 iexplore.exe 4192 IEXPLORE.EXE 4192 IEXPLORE.EXE 4696 iexplore.exe 4696 iexplore.exe 3336 IEXPLORE.EXE 3336 IEXPLORE.EXE 780 iexplore.exe 780 iexplore.exe 4272 IEXPLORE.EXE 4272 IEXPLORE.EXE 4904 iexplore.exe 4904 iexplore.exe 4424 IEXPLORE.EXE 4424 IEXPLORE.EXE 656 iexplore.exe 656 iexplore.exe 3992 IEXPLORE.EXE 3992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4640 wrote to memory of 516 4640 iexplore.exe 82 PID 4640 wrote to memory of 516 4640 iexplore.exe 82 PID 4640 wrote to memory of 516 4640 iexplore.exe 82 PID 864 wrote to memory of 1316 864 iexplore.exe 84 PID 864 wrote to memory of 1316 864 iexplore.exe 84 PID 864 wrote to memory of 1316 864 iexplore.exe 84 PID 1716 wrote to memory of 2372 1716 iexplore.exe 86 PID 1716 wrote to memory of 2372 1716 iexplore.exe 86 PID 1716 wrote to memory of 2372 1716 iexplore.exe 86 PID 1568 wrote to memory of 4192 1568 iexplore.exe 88 PID 1568 wrote to memory of 4192 1568 iexplore.exe 88 PID 1568 wrote to memory of 4192 1568 iexplore.exe 88 PID 4696 wrote to memory of 3336 4696 iexplore.exe 90 PID 4696 wrote to memory of 3336 4696 iexplore.exe 90 PID 4696 wrote to memory of 3336 4696 iexplore.exe 90 PID 780 wrote to memory of 4272 780 iexplore.exe 92 PID 780 wrote to memory of 4272 780 iexplore.exe 92 PID 780 wrote to memory of 4272 780 iexplore.exe 92 PID 4904 wrote to memory of 4424 4904 iexplore.exe 94 PID 4904 wrote to memory of 4424 4904 iexplore.exe 94 PID 4904 wrote to memory of 4424 4904 iexplore.exe 94 PID 656 wrote to memory of 3992 656 iexplore.exe 96 PID 656 wrote to memory of 3992 656 iexplore.exe 96 PID 656 wrote to memory of 3992 656 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\528b0a5e035635c64a71c7db288ec18036ae01c6b1be4fb881efcf66480ce82a.exe"C:\Users\Admin\AppData\Local\Temp\528b0a5e035635c64a71c7db288ec18036ae01c6b1be4fb881efcf66480ce82a.exe"1⤵PID:4688
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4640 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:864 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2372
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:4192
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4696 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3336
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4272
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4904 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:4424
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:656 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3992
-