Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 07:59
Static task
static1
General
-
Target
262d2c54d8610da4195da52f9f7c79fee3b6de77c0f0d87f3bbef3d9a92f4c13.exe
-
Size
880KB
-
MD5
b3f8d152ca9bd2796dc540d268555710
-
SHA1
734cb45b95ec03dc2c0ad0f0b9ace7bbf139113b
-
SHA256
262d2c54d8610da4195da52f9f7c79fee3b6de77c0f0d87f3bbef3d9a92f4c13
-
SHA512
245b87b723e6fd27f937ac0ded9927db9bb3619225e4fb118e556d025e66d346dde6dd4e7ede1ec40a23cfda943389d77664ec864af7474a97f4de8f061ae114
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000fe0f2263223fd1840a54a2b36ecac06c433e7cef7c0e86166a2ea318ee80ce3f000000000e8000000002000020000000b382f2deb307340cac49f5beecb1a7a8243216173862c95d70902a5bb593760c20000000276724f027da871eeb64b6cabad26affd305524c678a709a8105d8b7e438ac62400000004be38f5459bf6834a27642e41e27d3d428b1f22a8a01e7101a5a9e6d5754b2359669132d1578b408e4b10ba68e62b41a0b9133ecaa70ebfbf149e2a96a7f095e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1879994879" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE219BD7-120C-11EC-A248-CE52A13D30BF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000b8908f012a25cd26a0b5204e3c2799852a79f6454d2a277331762459823d22e8000000000e80000000020000200000002a41b2e63bfca29676879cd2afa52c5227cb58cffa63ef28393cf251171dbb56200000009e591709f188cd3a1f0ab1cb9e73cab9894ae971406241dffc94ca12383e036140000000cf09f8cbf2fb24620c8146233132836f4010c5ff1fde9ea9c9b6a9610b679e789d3dccf1f7fce23e813e0e0ec6d131239279ab75d7b40a39f471fd0e36cc65bc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000a4f75047900a55c8f4321698a0aa33342049b3cafbb50eefeb7d6e83f7883373000000000e800000000200002000000086728ab92ca9bbbdc1b90d6862b79f5fb507d47a22acc75f097806f3619441df20000000861d5493ade8372ec03c2e93006254d1b9964b8082e596ee56efafb3e3f82bfc40000000a0e54fc4b8b47a8fb915e8783dbbf46368abaa47a8778e5ea6e40b2f3d6249eb041e9dc539bb43fc40a9469a25179919b0323f56dfaf1b007cf0a2f3bfd6d839 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5096109319a6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000d56b378652a3b8ef63aa631285b909a9c393a917c940f2aef679d4813c5a0afd000000000e800000000200002000000059ef81e37aaffce3b72c9e43878311d8e3a4b3ccec72592f647f3db0d1679a96200000006fafbd17f03f2556e5872548abe69cdaf6ab94132b02200252979b864da9e16940000000034899b44ca3dd28552397f7ad7651bb716d046086f62b1cb5fc5428151baed629aafabed83073a40dc8c1167e7c79a76e7c5bc572607e16c788ba0252176550 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000009a760f15e26258f711a98b91e88fdb5ac002015e5fd2c861456348cf4bf24baf000000000e8000000002000020000000c7a9cf42360b3151e1de672d78747ed64a71fce69de23ab429bd1a88b8f2de6320000000967aa399f2c69e59822b71f75f93969c699dd40cdfdc7667f6ef964c8b6ab468400000003f08e68afa5942c090a90b556fc7ada4e869c593d8177ddefdfab99f071134c7fed1534c720d7b3119dcecfc785c795ed97349a784e642d36d32d80fea0a08a2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00779d7019a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B588F01A-120C-11EC-A248-CE52A13D30BF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30909977" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000a5acc54fee852c8e8ad6edfdaaea16b9eab9c0d17060fbba332010a7549eda25000000000e8000000002000020000000b793462ea45c12c1c34e7706f11735dd1d5e81d84af9f2461ce8e29d0240b11e200000007fc15379b8765a1b74301252f2e59503eee8eaaa9383686c4cffca9eca4fc3f2400000009af0d72c40609647cc077eb7af18950721914c222e945a1320c2c74be5ae12f33ef3b9924750fdc43b84936c6d94bff8e8ce112c324ff78fcc55383b0d6a2bef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C961A35A-120C-11EC-A248-CE52A13D30BF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300a3f7f19a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30909977" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE9B1AE8-120C-11EC-A248-CE52A13D30BF} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1692 iexplore.exe 2184 iexplore.exe 2176 iexplore.exe 2016 iexplore.exe 424 iexplore.exe 3836 iexplore.exe 2092 iexplore.exe 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 1692 iexplore.exe 1692 iexplore.exe 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 2184 iexplore.exe 2184 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2176 iexplore.exe 2176 iexplore.exe 3920 IEXPLORE.EXE 3920 IEXPLORE.EXE 2016 iexplore.exe 2016 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 424 iexplore.exe 424 iexplore.exe 1508 IEXPLORE.EXE 1508 IEXPLORE.EXE 3836 iexplore.exe 3836 iexplore.exe 3968 IEXPLORE.EXE 3968 IEXPLORE.EXE 2092 iexplore.exe 2092 iexplore.exe 3840 IEXPLORE.EXE 3840 IEXPLORE.EXE 2292 iexplore.exe 2292 iexplore.exe 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3612 1692 iexplore.exe 82 PID 1692 wrote to memory of 3612 1692 iexplore.exe 82 PID 1692 wrote to memory of 3612 1692 iexplore.exe 82 PID 2184 wrote to memory of 2612 2184 iexplore.exe 84 PID 2184 wrote to memory of 2612 2184 iexplore.exe 84 PID 2184 wrote to memory of 2612 2184 iexplore.exe 84 PID 2176 wrote to memory of 3920 2176 iexplore.exe 86 PID 2176 wrote to memory of 3920 2176 iexplore.exe 86 PID 2176 wrote to memory of 3920 2176 iexplore.exe 86 PID 2016 wrote to memory of 2612 2016 iexplore.exe 88 PID 2016 wrote to memory of 2612 2016 iexplore.exe 88 PID 2016 wrote to memory of 2612 2016 iexplore.exe 88 PID 424 wrote to memory of 1508 424 iexplore.exe 90 PID 424 wrote to memory of 1508 424 iexplore.exe 90 PID 424 wrote to memory of 1508 424 iexplore.exe 90 PID 3836 wrote to memory of 3968 3836 iexplore.exe 92 PID 3836 wrote to memory of 3968 3836 iexplore.exe 92 PID 3836 wrote to memory of 3968 3836 iexplore.exe 92 PID 2092 wrote to memory of 3840 2092 iexplore.exe 94 PID 2092 wrote to memory of 3840 2092 iexplore.exe 94 PID 2092 wrote to memory of 3840 2092 iexplore.exe 94 PID 2292 wrote to memory of 1692 2292 iexplore.exe 96 PID 2292 wrote to memory of 1692 2292 iexplore.exe 96 PID 2292 wrote to memory of 1692 2292 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\262d2c54d8610da4195da52f9f7c79fee3b6de77c0f0d87f3bbef3d9a92f4c13.exe"C:\Users\Admin\AppData\Local\Temp\262d2c54d8610da4195da52f9f7c79fee3b6de77c0f0d87f3bbef3d9a92f4c13.exe"1⤵PID:4020
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3920
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:424 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3836 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3840
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1692
-