Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 06:37
Static task
static1
General
-
Target
8248e24ba881cb294561ba1a9cdd2cb71e8d45a903745272ec634bc20f784e7c.exe
-
Size
880KB
-
MD5
3dfcd5591955be4d0a1c66fc9fac49d6
-
SHA1
265ad6dd560447ecf0d74a4cf7ca3e0fc1500ff0
-
SHA256
8248e24ba881cb294561ba1a9cdd2cb71e8d45a903745272ec634bc20f784e7c
-
SHA512
99be4440515d15bbec5e2c1cad6cff16853893b83e6b5838c0337d83dc5492d2d95d8138b23391ad249777eb94e4f4c94181b2a9b0bd7aae372c431ef871c193
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30909983" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a29ae5b800e8b4cae7f210c16c2238700000000020000000000106600000001000020000000ba4504998fd3216aab0240a8d5b37ef1bd619449b47f1e89aad974109fdc7fe3000000000e80000000020000200000004e3514859bc51db9d36ae1fee353e9d1a40db8d306decbf14dbfcaaa5e145bb920000000f444216ba4883a7b468c3cb06ba12b4dc773b91c706a2822a2a0fff26882d358400000007a95da2ccba13c249261d3aad23a2802497c9c3cc3c1f9fc7af1a2de8b0bfb71c97214e3a9210dd8cdb64c688eba1d584080a45d59958eb8c5e35b3d04a9f3a7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f041a5cf1fa6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1CA2E71-1212-11EC-B2DB-5A4A21AC7400} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a29ae5b800e8b4cae7f210c16c223870000000002000000000010660000000100002000000074d53ef08561ee71091664ec337e3cf3be7bf809b3586edac34762d86e2c1921000000000e80000000020000200000007df0c856347a1801d8f25a2573b210517c70107b02bb8032bd18d45412058a6320000000511476b713d4ccebca3111f57e0e3e45b250e8c8d368ae1038d13b9e41497c3b40000000bf6c0127ba0e2d809f7ae0a7c058cf7a6b6cf45b3baefcc3a0ccdfb72f6b0616f926aa8ee3c5de45d90bb33bc1bf8a473f3947b7f35c23a054b6f6744fdfdd0a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a29ae5b800e8b4cae7f210c16c2238700000000020000000000106600000001000020000000db0ad9f5c03bf5ecc470bf942a237102ac33dd0cf075529fbda7837e5956346e000000000e80000000020000200000004ba6922b9ba842bfee7159f69fca200b8e657ebce023ca84453384ca4eba3b1220000000079dbd25e23a705135753fd724f9b07b2a85fc5f4efd1c04ff977df5e24c4f434000000028ed86aa1009ce06f73102e43a78019e6ad5762966ff8c86892ca25c4182cdf9c43eda88e78bc15080c101020f19ebfa73580c70abc73c640b333dc20065a579 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a29ae5b800e8b4cae7f210c16c2238700000000020000000000106600000001000020000000ce45cb741dcfe2e0edab335674f5e9c0260a0403301de55cb216440c2c4344b1000000000e8000000002000020000000b3e6515c31fe89d06aca16d410bff601c7c86de2a5d014992faeaae1d98876c62000000088e726fc97b58b1d682c619225fc5259814c9f80a36151b085a06c7a80f04b8940000000e228e61559664df33d2590082485ebeb1a0ed187a121259239be49c20e638cc1b11574067fdaf6aed56a21026aa107a7d85a136f0cfb00ea3a739258e6dee346 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05C1DFC3-1213-11EC-B2DB-5A4A21AC7400} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cdabdd1fa6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4AD3702-1212-11EC-B2DB-5A4A21AC7400} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a29ae5b800e8b4cae7f210c16c22387000000000200000000001066000000010000200000008785d23d3f2c2a5ff48e9f7f180e11b0a68b4b97378a5869ff85a64f5f6ed5be000000000e800000000200002000000048ab73c8027cb5000a2e56a8d42bd71d70f857f441931c0b231d8b509c815adf2000000023dcbbb4c9980083fecd4b7c2285797d1aa6c42de7167416ebf632dc0c234383400000004e9722f4b26cd0addfefb15352b5895dcf96b319395687f1db09c893ec04e1684664297fdda6d3a28986d321b1d7223be67f4f8d0cd7365e8cf6614dab058c5a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2840747205" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAC94597-1212-11EC-B2DB-5A4A21AC7400} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3564 iexplore.exe 2076 iexplore.exe 3344 iexplore.exe 3864 iexplore.exe 3496 iexplore.exe 3080 iexplore.exe 1300 iexplore.exe 508 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 3564 iexplore.exe 3564 iexplore.exe 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE 2076 iexplore.exe 2076 iexplore.exe 1260 IEXPLORE.EXE 1260 IEXPLORE.EXE 3344 iexplore.exe 3344 iexplore.exe 1320 IEXPLORE.EXE 1320 IEXPLORE.EXE 3864 iexplore.exe 3864 iexplore.exe 3768 IEXPLORE.EXE 3768 IEXPLORE.EXE 3496 iexplore.exe 3496 iexplore.exe 3444 IEXPLORE.EXE 3444 IEXPLORE.EXE 3080 iexplore.exe 3080 iexplore.exe 1544 IEXPLORE.EXE 1544 IEXPLORE.EXE 1300 iexplore.exe 1300 iexplore.exe 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 508 iexplore.exe 508 iexplore.exe 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3564 wrote to memory of 3140 3564 iexplore.exe 81 PID 3564 wrote to memory of 3140 3564 iexplore.exe 81 PID 3564 wrote to memory of 3140 3564 iexplore.exe 81 PID 2076 wrote to memory of 1260 2076 iexplore.exe 83 PID 2076 wrote to memory of 1260 2076 iexplore.exe 83 PID 2076 wrote to memory of 1260 2076 iexplore.exe 83 PID 3344 wrote to memory of 1320 3344 iexplore.exe 85 PID 3344 wrote to memory of 1320 3344 iexplore.exe 85 PID 3344 wrote to memory of 1320 3344 iexplore.exe 85 PID 3864 wrote to memory of 3768 3864 iexplore.exe 87 PID 3864 wrote to memory of 3768 3864 iexplore.exe 87 PID 3864 wrote to memory of 3768 3864 iexplore.exe 87 PID 3496 wrote to memory of 3444 3496 iexplore.exe 89 PID 3496 wrote to memory of 3444 3496 iexplore.exe 89 PID 3496 wrote to memory of 3444 3496 iexplore.exe 89 PID 3080 wrote to memory of 1544 3080 iexplore.exe 91 PID 3080 wrote to memory of 1544 3080 iexplore.exe 91 PID 3080 wrote to memory of 1544 3080 iexplore.exe 91 PID 1300 wrote to memory of 1032 1300 iexplore.exe 93 PID 1300 wrote to memory of 1032 1300 iexplore.exe 93 PID 1300 wrote to memory of 1032 1300 iexplore.exe 93 PID 508 wrote to memory of 3140 508 iexplore.exe 95 PID 508 wrote to memory of 3140 508 iexplore.exe 95 PID 508 wrote to memory of 3140 508 iexplore.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\8248e24ba881cb294561ba1a9cdd2cb71e8d45a903745272ec634bc20f784e7c.exe"C:\Users\Admin\AppData\Local\Temp\8248e24ba881cb294561ba1a9cdd2cb71e8d45a903745272ec634bc20f784e7c.exe"1⤵PID:656
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3344 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1320
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3864 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3496 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3080 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1032
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:508 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3140
-