Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 08:05
Static task
static1
General
-
Target
6aeadd71c6ab3943eea9fbc79dc51be0a676ac89dce090e1d1c35175e4c7e28f.exe
-
Size
880KB
-
MD5
9ec060888bbc19f9464aedca3da6f282
-
SHA1
d4d262b2330ab756a75eab1fba45efd9db888cc8
-
SHA256
6aeadd71c6ab3943eea9fbc79dc51be0a676ac89dce090e1d1c35175e4c7e28f
-
SHA512
c19d9e865cea75f7539263dcc215536d88312cb37069570b864648bf5441354f52a6f952d1477d9e1bf49c20f6e95466436a55d1d8fe67b98d501a21df40a0ea
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009496591aa6d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4057576d1aa6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d4610000000002000000000010660000000100002000000034906243e405ef49c0c2b77dddc19640d59fb2370253550581fc96d17f30315a000000000e8000000002000020000000a126c8f1c8aa029a41dc7ee6c629b84bb11c0f1446113b9c7aa7d7ba6b648ef120000000343d7835063aefb438b24c0fff33e6031ec504e5206f21f0b71d09c23204291940000000f1c1d782488a3f8f1b4d8769ffebe71f6cacf2dd65a9a33060edbd801478c0c64ef7d9df448d970da37baece662a3ed44376c9f1da13dee1f52813e442d52616 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000f56189a836030c8941c404dcbcdd01d5bcc0c6c9038330f6fdff1e98dd5b0477000000000e8000000002000020000000e07b139e464027931c85774011df3f4636b7c39f045da428005b9e5956e0ae582000000074c0166ce25e1de84e6d5c937db916d38275a2af254406cda18ba70ccf6cc68f40000000fcad3e8a0ac49480741f53e0e614a715ec03f20def8ccd47c01a4fa8ebb62cfce9aba1933113369d955b03f2d51c75c3a1a8f59fbfe8c3a10edcbf53ad8ef32c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3B46C2C-120D-11EC-A248-762EDC6E4461} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000001f3ed5f946f27b8492295f782838de429e1102940edac13c8f9f062b74fb868b000000000e8000000002000020000000d6163dad30eab3bd09af61ef92e89dd6835b3af88a178a647537e13721f64e2b2000000001a61593d9f6c09286301271854e3023de8a640b68a771fc644f58af66505e264000000034db4e39c9273d282c88faaa7b30eab0ec897e353885b8267a1ac3e17d6155900d3ab0f9368518af36a0fcce087dab1b9357247fe3c2e44316c5d628c876ae97 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bea8521aa6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88F9CF40-120D-11EC-A248-762EDC6E4461} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B86F9E07-120D-11EC-A248-762EDC6E4461} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dbce4a1aa6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000695eaf5a5ff4def714f423403436a4389913b7e00f75cfa0e27c8bde22ea69f5000000000e80000000020000200000005ecdd5ec31be5a3c2e558c06c2b8ef73e2abc5382c2a06897feb5a474355f55220000000a8b3f1893f3d23f7aacfc3400f0ba01bb7033cec416f5c36766d71bb46ac7fae4000000048050519f5fe932651c3b963e053e415ae866711a0c5bf27aaa8da50e748d45429a0aeafe0d23208298708057397a340ac3efabd431a0a9d19c8b9d911f4705a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0003e741aa6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ad70661aa6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA98B8B4-120D-11EC-A248-762EDC6E4461} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000003f27b226d066aba019120628f2c54138d3ac67af788f87f5572db86a0677f2a8000000000e8000000002000020000000086ff6ebd0a2350ea0fa320e56a8d030852c5554c83a5b41b69636f4c36bd8562000000021c0dc5412f75435306a1c5df19ba91bc2e4d7c4ddb5ad8da8bbf2b2133f6de840000000faeda45f95856d40525c7ad9a5950216c0a4d331ce8407dca74eacc4ef7b5c4be92fec8ae9714e55214c252e848315ae8654d9c36e4fa8c9a4816f0f4bb3ff29 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96D31786-120D-11EC-A248-762EDC6E4461} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2007d64a1aa6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 732 iexplore.exe 524 iexplore.exe 3948 iexplore.exe 3796 iexplore.exe 1812 iexplore.exe 1536 iexplore.exe 3832 iexplore.exe 3280 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 732 iexplore.exe 732 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 524 iexplore.exe 524 iexplore.exe 3276 IEXPLORE.EXE 3276 IEXPLORE.EXE 3948 iexplore.exe 3948 iexplore.exe 872 IEXPLORE.EXE 872 IEXPLORE.EXE 3796 iexplore.exe 3796 iexplore.exe 3204 IEXPLORE.EXE 3204 IEXPLORE.EXE 1812 iexplore.exe 1812 iexplore.exe 956 IEXPLORE.EXE 956 IEXPLORE.EXE 1536 iexplore.exe 1536 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 3832 iexplore.exe 3832 iexplore.exe 524 IEXPLORE.EXE 524 IEXPLORE.EXE 3280 iexplore.exe 3280 iexplore.exe 3436 IEXPLORE.EXE 3436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 732 wrote to memory of 2092 732 iexplore.exe 82 PID 732 wrote to memory of 2092 732 iexplore.exe 82 PID 732 wrote to memory of 2092 732 iexplore.exe 82 PID 524 wrote to memory of 3276 524 iexplore.exe 84 PID 524 wrote to memory of 3276 524 iexplore.exe 84 PID 524 wrote to memory of 3276 524 iexplore.exe 84 PID 3948 wrote to memory of 872 3948 iexplore.exe 86 PID 3948 wrote to memory of 872 3948 iexplore.exe 86 PID 3948 wrote to memory of 872 3948 iexplore.exe 86 PID 3796 wrote to memory of 3204 3796 iexplore.exe 88 PID 3796 wrote to memory of 3204 3796 iexplore.exe 88 PID 3796 wrote to memory of 3204 3796 iexplore.exe 88 PID 1812 wrote to memory of 956 1812 iexplore.exe 90 PID 1812 wrote to memory of 956 1812 iexplore.exe 90 PID 1812 wrote to memory of 956 1812 iexplore.exe 90 PID 1536 wrote to memory of 2056 1536 iexplore.exe 92 PID 1536 wrote to memory of 2056 1536 iexplore.exe 92 PID 1536 wrote to memory of 2056 1536 iexplore.exe 92 PID 3832 wrote to memory of 524 3832 iexplore.exe 94 PID 3832 wrote to memory of 524 3832 iexplore.exe 94 PID 3832 wrote to memory of 524 3832 iexplore.exe 94 PID 3280 wrote to memory of 3436 3280 iexplore.exe 96 PID 3280 wrote to memory of 3436 3280 iexplore.exe 96 PID 3280 wrote to memory of 3436 3280 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aeadd71c6ab3943eea9fbc79dc51be0a676ac89dce090e1d1c35175e4c7e28f.exe"C:\Users\Admin\AppData\Local\Temp\6aeadd71c6ab3943eea9fbc79dc51be0a676ac89dce090e1d1c35175e4c7e28f.exe"1⤵PID:3340
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:732 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:524 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3276
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3948 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:872
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3796 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3204
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2056
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:524
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3280 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3436
-