Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 10:12
Static task
static1
General
-
Target
f5bc1cf668268c82577f31e4b6ab3124229987b9e380f6c96aeae9793bf46c56.exe
-
Size
880KB
-
MD5
ace5f9de71f6680c96ef7b48210a20f3
-
SHA1
134f3227111014a37fd1353ed0cd716393b2df24
-
SHA256
f5bc1cf668268c82577f31e4b6ab3124229987b9e380f6c96aeae9793bf46c56
-
SHA512
d7be34844b6fd1d224f7135eb953e5352786942156053a1f1a38f8f15a8131962acb9df9e69a3daac0b6a5fdf0be60ecbeecf1607044a1194899a4cc81b8ee49
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b759972ca6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000d7a066e9f524fc47611ba056395e788011a27b06da680e95aa1c5f4e38614511000000000e8000000002000020000000058008b2578adcfc26529d86fe2641ea14825a55cddafac03731e466a73653c2200000003cf4e7019f907939dc0edf64f838f3c80be5477e9d876a0e09f2761474f4ed7e40000000e092270f52c0bfcb6a4f28015e01acd23b7bafebdd5a70954727eb5c4f7adc45377c30b61604ad6e938f4bdc7afe929553df52cb70f79316b90ebbe339561f66 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDB46F11-121F-11EC-A248-CA968FB30DDD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D49B1FF6-121F-11EC-A248-CA968FB30DDD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000003457da2ff8f8a0224ff11e9001a2a353338a05c9985a3065970efbfdc171ba60000000000e8000000002000020000000bdea76515074d50cc1471f344192f066f2613676fcc27c296c238bc4f8616aac2000000056e9aac5709b24080492cea7b9843af860b1f88a7d28f906cab7b730a79a67784000000082948c4cb6ce28d03a8fac81e2394dcaf96d53b4d5d65b5f080c43afd948e4d9294c93710e235380d386ec0e7209b05f97683f0291718f6ff7363f6238aae6ee iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6354193-121F-11EC-A248-CA968FB30DDD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000862d7bc238c773a2143a16d9ca1a328f62d2855c702aef0208827e792f270253000000000e8000000002000020000000bd2bbeb1ebf9256d0c214ff520ec8fdea6e220b3343357d53b06262bfd8331d9200000001e6c846fe3f17be6af241c606980227c7ae3862153ef3b7d857de97a5797801440000000bbe3ed354110085dbcde283bc559e6f19357200b25f238dd75adfecbb8f56f866a51f222240b757839b669c661e2af6e22717e6dea9c30d11f6923f2ada2662f iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0638c892ca6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000003d1f2e2a74e8f5243ef654daa2b458297a3245a7e8bb46df9dc02696d55bbb72000000000e800000000200002000000096c1ac7963f283dd111c3d084ac7d9d13f29c00f7fc7b53595dd4c4cb53b7c5a200000008ddf442add3ca6784a2819e4ed898d0f968dbb2fb5002683f57e55a3d4a61707400000001d2878a594ce5369995aa4c867586606735b05cc8b9ee93f8ff7817ef9215cd329079e302f49ab0593ff1f172973f925d7e0c8fa0c0c1acf1fcea05edd18a96f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000006ef12a24baacaf9d54b84926a7f5afa9debb3e46974bc6414e5d7820a41cb2d3000000000e80000000020000200000009a0ccbdeee31a538153f898427038668a0baa0aa84e8558b1ccdb89448e95e092000000040c0a38915ba2910f24864f243a61de9b424d1ae27ceff14c105ac9d6cabf274400000007dad9903fd1dae6d58cf116ea6bc79f2183266ae6bea157ee69c67a74ed316a9e94eef0bb2c7ae531e892caedfc096d78c2e0b8c91bba0783924fe376eca1448 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000005b567966593d7a2b0827983f248b2900bcf3cca0ce67775749bfbad4bbf7c2ba000000000e8000000002000020000000fcf40b461441202b38fb3cd042a1706294254f4a08cbf553b86582cac1cb7a0a200000009b0d5cb4fbe81258b0563987a0b22191f49307276db4f5417c22ecd8f5a3250f40000000bd7d90293fbf387988c641495b2b84d6ea577bef887e2832088bd2fe9f3e458f3f64cfcdf368f90361f822be65753680ac3d37a8637147402f31acbb524f995b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ce16b22ca6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000006bcee42c8475c27c24a751fcd3b1b3cd5cbe9f2335ddd91a6bf14a665f5f11fd000000000e8000000002000020000000b4a64a89a07e6294d5e3d66694ea828ca906abf356ef2cd22d88151cb92b6a2920000000d0c868e59f29b7eb4e1e91597a5576aed78b8c2bc203f9c3c6b2a2278ac3a32b400000002af40686cbb9b95f6897c55a266fce990175973c86ff606c73c63bd3e9b96647e3f07e6bab07b91f04182d9144a7157292d935ed20b2a4685f6074712be487ad iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E859A445-121F-11EC-A248-CA968FB30DDD} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3952 iexplore.exe 816 iexplore.exe 3408 iexplore.exe 624 iexplore.exe 3816 iexplore.exe 952 iexplore.exe 3776 iexplore.exe 692 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 3952 iexplore.exe 3952 iexplore.exe 4044 IEXPLORE.EXE 4044 IEXPLORE.EXE 816 iexplore.exe 816 iexplore.exe 620 IEXPLORE.EXE 620 IEXPLORE.EXE 3408 iexplore.exe 3408 iexplore.exe 3608 IEXPLORE.EXE 3608 IEXPLORE.EXE 624 iexplore.exe 624 iexplore.exe 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE 3816 iexplore.exe 3816 iexplore.exe 3448 IEXPLORE.EXE 3448 IEXPLORE.EXE 952 iexplore.exe 952 iexplore.exe 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE 3776 iexplore.exe 3776 iexplore.exe 3548 IEXPLORE.EXE 3548 IEXPLORE.EXE 692 iexplore.exe 692 iexplore.exe 3640 IEXPLORE.EXE 3640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3952 wrote to memory of 4044 3952 iexplore.exe 72 PID 3952 wrote to memory of 4044 3952 iexplore.exe 72 PID 3952 wrote to memory of 4044 3952 iexplore.exe 72 PID 816 wrote to memory of 620 816 iexplore.exe 74 PID 816 wrote to memory of 620 816 iexplore.exe 74 PID 816 wrote to memory of 620 816 iexplore.exe 74 PID 3408 wrote to memory of 3608 3408 iexplore.exe 78 PID 3408 wrote to memory of 3608 3408 iexplore.exe 78 PID 3408 wrote to memory of 3608 3408 iexplore.exe 78 PID 624 wrote to memory of 1592 624 iexplore.exe 85 PID 624 wrote to memory of 1592 624 iexplore.exe 85 PID 624 wrote to memory of 1592 624 iexplore.exe 85 PID 3816 wrote to memory of 3448 3816 iexplore.exe 87 PID 3816 wrote to memory of 3448 3816 iexplore.exe 87 PID 3816 wrote to memory of 3448 3816 iexplore.exe 87 PID 952 wrote to memory of 1796 952 iexplore.exe 89 PID 952 wrote to memory of 1796 952 iexplore.exe 89 PID 952 wrote to memory of 1796 952 iexplore.exe 89 PID 3776 wrote to memory of 3548 3776 iexplore.exe 91 PID 3776 wrote to memory of 3548 3776 iexplore.exe 91 PID 3776 wrote to memory of 3548 3776 iexplore.exe 91 PID 692 wrote to memory of 3640 692 iexplore.exe 93 PID 692 wrote to memory of 3640 692 iexplore.exe 93 PID 692 wrote to memory of 3640 692 iexplore.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5bc1cf668268c82577f31e4b6ab3124229987b9e380f6c96aeae9793bf46c56.exe"C:\Users\Admin\AppData\Local\Temp\f5bc1cf668268c82577f31e4b6ab3124229987b9e380f6c96aeae9793bf46c56.exe"1⤵PID:4008
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3952 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4044
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:620
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3608
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3816 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3776 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3548
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3640
-