Analysis
- max time kernel
141s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
2ed935e2467bc6328f823151f104f52abc3ad9de772e7a0623c9e370816cf6ba.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 2ed935e2467bc6328f823151f104f52abc3ad9de772e7a0623c9e370816cf6ba.exe
- Size 619KB
- Sample220520-14648aefc5
- SHA256 2ed935e2467bc6328f823151f104f52abc3ad9de772e7a0623c9e370816cf6ba
- MD5 856c9d9c2b9242cdf2628fff86c2ca36
- SHA1 578b1e772213dc4a75b0a46dd741b696825ebcfc
- SHA512 bbba44363e6d77708eb67a336adc485868b7461d66eea1c1cbdad44947938830b8cb94d10abe3f6e5715d723732e5719710d0b12336e660fe98005d9bc2940e2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gozi_rm3
Attributes
-
build
300900
Extracted
Family
-
gozi_rm3
Botnet
-
90020242
C2
-
https://vrhgroups.xyz
Attributes
-
build
300900
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20db91b6a76cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000005d3276c75c4136d9c66a81ab70953caf18f9ac41161e11c3c40d34ca9d29cb4d000000000e80000000020000200000002ee4f298b8a1baf593340f77792bf1f28d66d7f27101f696130d12c7f62203c42000000024a3d0f3b954c969c55d5c02dd62c8d82974f53c430a6327b44af01546749c2c400000001c39aaacda7baab21f42f99f7cf1a5d8fbb1ef48f7cba5892090d756f0419be5d26bfb2aad9222b8984bbfdf15665d49be6d6a9e67d8a12343fed0def4a4cfab iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{155EF95B-D89B-11EC-AC67-5ABF78284711} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000003360a9b60046bc87c395c160d4af3ef90482083ffba1625fad15aa0a5c175ea8000000000e8000000002000020000000fc625301e5d8966a7948d0e4fb165a0877313a9990af4293cdba64a74935432d20000000bdcb5bc23896e5f5643f8944464685376b526d1993270c342f1622368e2b700940000000fae52f75c2011cd015521f6b9a406edecabca8c26d178a83977759f566f4e60f2a722d23d6e5306d0382532ff85385034922772bf4d42e8aa0e047ecd30d7e14 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FAA921A7-D89A-11EC-AC67-5ABF78284711} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000ce1b94105b225ed0fca023027fe3564b1a319c96f759e670dd5769cfb7a51900000000000e8000000002000020000000af5346f918532dd4814a61c129be291faa78d771ada9adf156af6599710ff9fb20000000e46f6124d3da97c7bd70658bdd3a61a95617bd596eb2c3d7dc00f44946f31bb94000000075b913ac1d5f336d9f67463e203dc1efc5dbeed9ed55265867fab8ee373d4f5a879b993ab894f4d2f3466a2f64b2c7a457eea9d98f6478bab5acb1a6a32a470e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09cfbe5a76cd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b09150000000002000000000010660000000100002000000043b4fee188cbbeebe05c59f8f5130f4f68c4952372855062f6cdae7049aa59b5000000000e8000000002000020000000ccd93df342bc27cfc289462e2b0ff773ca25de96df7829716f0091914dcbc31420000000d9e532bfc280a0f39b9abbfbcdb829cd188d894fdecdeb45c37a133dc453d17440000000b0b3a29e791f6f796569156092de7152e8cb08c65431338f163e4a2c12eb9269a41c5d7f97640bb94f4c9a807ed97ee4816706db98680be311ee325d64c4bccd iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000004cc1b2599a5b3e19c2d8c587f58239208759146762d1c7f57f58b872051b03c4000000000e8000000002000020000000976800fc7cc1a2006695c22211f016eb461a2fe15a3f5c9578d31bebd4bb8b1e200000004ea855019465cda4c76dc8b677e151181df6db73f1d70a7875b9294454e6a3ed40000000d004f47b2337a335a250ef6b1b8181041a0c23eedbb269f41ca8a6f97571f9490c6dbf6c5c7e9852e0e5a9457034f952a71aa739acee69a1305b786b328b59be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09288b3a76cd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0E7AA968-D89B-11EC-AC67-5ABF78284711} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000d266ff1f453d86f0e83154de2a3f50b589a3fdacc56f9d729b8769f9e9b85c58000000000e80000000020000200000008d6a3685dd8d328bbb62a51c65b16ed9c21a6c3b730779956d1fadcbb1877a3820000000454464060022583d1ec46368efaee29d4af0895a9ee88120278eee322214bbc440000000ac038a7f9b14d2e53fba5795af4bc6781af8e07453629fbd09202da7eecd9e3902caf3d505a9533fe5f1ec496887d3de11959f2e844f864ba15f161f94097cbe iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400c09dfa76cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F3C27109-D89A-11EC-AC67-5ABF78284711} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002a3ed1a76cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b09150000000002000000000010660000000100002000000036a45c5d384a9649e5e3132ad88e4abc4c187d5b3f342fc07692e7032ec88a89000000000e80000000020000200000006fa60afd6da34e09fc0a3175657a680ab150d41c63bd793e098d22d949a567aa20000000ea34e81ccb700b61186bbe33c9a9d17514a920c2986c4c1f970cc5b07f7d322e400000002e2fe63dca30e3cd00dcd138ba8b6d17d445e933a379e4d0160a89a063f911ecf28e269249b62c948b1f148152857ef37440b234bb4200a3a1d6fbb1ecef3e0e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2985826441" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1440 iexplore.exe 4236 iexplore.exe 4720 iexplore.exe 3304 iexplore.exe 5108 iexplore.exe 1992 iexplore.exe 3084 iexplore.exe 1692 iexplore.exe - Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 1440 iexplore.exe 1440 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 4236 iexplore.exe 4236 iexplore.exe 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 4720 iexplore.exe 4720 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 3304 iexplore.exe 3304 iexplore.exe 3312 IEXPLORE.EXE 3312 IEXPLORE.EXE 5108 iexplore.exe 5108 iexplore.exe 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1992 iexplore.exe 1992 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 3084 iexplore.exe 3084 iexplore.exe 3672 IEXPLORE.EXE 3672 IEXPLORE.EXE 1692 iexplore.exe 1692 iexplore.exe 4380 IEXPLORE.EXE 4380 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1440 wrote to memory of 2264 1440 iexplore.exe 91 PID 1440 wrote to memory of 2264 1440 iexplore.exe 91 PID 1440 wrote to memory of 2264 1440 iexplore.exe 91 PID 4236 wrote to memory of 1588 4236 iexplore.exe 96 PID 4236 wrote to memory of 1588 4236 iexplore.exe 96 PID 4236 wrote to memory of 1588 4236 iexplore.exe 96 PID 4720 wrote to memory of 1996 4720 iexplore.exe 98 PID 4720 wrote to memory of 1996 4720 iexplore.exe 98 PID 4720 wrote to memory of 1996 4720 iexplore.exe 98 PID 3304 wrote to memory of 3312 3304 iexplore.exe 100 PID 3304 wrote to memory of 3312 3304 iexplore.exe 100 PID 3304 wrote to memory of 3312 3304 iexplore.exe 100 PID 5108 wrote to memory of 1084 5108 iexplore.exe 102 PID 5108 wrote to memory of 1084 5108 iexplore.exe 102 PID 5108 wrote to memory of 1084 5108 iexplore.exe 102 PID 1992 wrote to memory of 1984 1992 iexplore.exe 104 PID 1992 wrote to memory of 1984 1992 iexplore.exe 104 PID 1992 wrote to memory of 1984 1992 iexplore.exe 104 PID 3084 wrote to memory of 3672 3084 iexplore.exe 106 PID 3084 wrote to memory of 3672 3084 iexplore.exe 106 PID 3084 wrote to memory of 3672 3084 iexplore.exe 106 PID 1692 wrote to memory of 4380 1692 iexplore.exe 108 PID 1692 wrote to memory of 4380 1692 iexplore.exe 108 PID 1692 wrote to memory of 4380 1692 iexplore.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ed935e2467bc6328f823151f104f52abc3ad9de772e7a0623c9e370816cf6ba.exe"C:\Users\Admin\AppData\Local\Temp\2ed935e2467bc6328f823151f104f52abc3ad9de772e7a0623c9e370816cf6ba.exe"1⤵PID:3124
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4576
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4236 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1588
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4720 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3304 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3312
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5108 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3084 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3672
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:4380
-