Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

231114-vxdw7sdg61 10

28/10/2023, 19:29

231028-x7cs1age56 10

24/10/2023, 13:29

231024-qrn3rsdb6z 10

18/10/2023, 12:04

231018-n8ybnaeb31 10

07/09/2023, 12:10

230907-pce1wahe2x 10

Analysis

  • max time kernel
    1791s
  • max time network
    1791s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2023, 12:04

General

  • Target

    bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe

  • Size

    137KB

  • MD5

    34796bb71a194c4efe6154b46db6f4e4

  • SHA1

    d1518518198c23fe4226ed61b52c4c7844246fe1

  • SHA256

    bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0

  • SHA512

    6fbd87c03417aba7875ec07f42dfc078dcb5e36cdf3f80657d97087651a77f49a2345336e841a486e89c66c8e373fc7e19a572ab5124dad51eb01829df5a2472

  • SSDEEP

    3072:62BuFSglbxkKbjDOfuCtihXwnTP/vhaBxVGVq0OP:62BuFSglbxkKbjDOfvixwjhaYVE

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe
    "C:\Users\Admin\AppData\Local\Temp\bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe"
    1⤵
      PID:4816
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:1168
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4320 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:4960
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3568 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:3836
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5084 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:1720
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4828 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:1492
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3136 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2112
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:4148
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:3492
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4452 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2960
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4600 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:540
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4624 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:4772
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4288 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2600
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3712
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3712 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2244
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5004 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:3936
      • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
        "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
        1⤵
          PID:4684
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5068
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5068 CREDAT:17410 /prefetch:2
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:2468
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1608
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:17410 /prefetch:2
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:4668
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:384
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:17410 /prefetch:2
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:2284
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3496
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3496 CREDAT:17410 /prefetch:2
            2⤵
              PID:3580
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2996
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:17410 /prefetch:2
              2⤵
                PID:212
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1216
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:17410 /prefetch:2
                2⤵
                  PID:4956
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                1⤵
                • Modifies Internet Explorer settings
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:2972
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:17410 /prefetch:2
                  2⤵
                    PID:2472
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                  1⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3116
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3116 CREDAT:17410 /prefetch:2
                    2⤵
                      PID:2912
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                    1⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:976
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:17410 /prefetch:2
                      2⤵
                        PID:2908
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2928
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:17410 /prefetch:2
                        2⤵
                          PID:4500
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:2088
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:17410 /prefetch:2
                          2⤵
                            PID:4980
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                          1⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of FindShellTrayWindow
                          PID:2428
                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:17410 /prefetch:2
                            2⤵
                              PID:4808
                          • C:\Program Files\Internet Explorer\iexplore.exe
                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:3468
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3468 CREDAT:17410 /prefetch:2
                              2⤵
                                PID:404
                            • C:\Program Files\Internet Explorer\iexplore.exe
                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                              1⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of FindShellTrayWindow
                              PID:3720
                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:17410 /prefetch:2
                                2⤵
                                  PID:1256
                              • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                1⤵
                                  PID:2776
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of FindShellTrayWindow
                                  PID:4768
                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4768 CREDAT:17410 /prefetch:2
                                    2⤵
                                      PID:4248
                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                    1⤵
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1248
                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:17410 /prefetch:2
                                      2⤵
                                        PID:2004
                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                      1⤵
                                      • Modifies Internet Explorer settings
                                      • Suspicious use of FindShellTrayWindow
                                      PID:2688
                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:17410 /prefetch:2
                                        2⤵
                                          PID:1960
                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                        1⤵
                                        • Modifies Internet Explorer settings
                                        • Suspicious use of FindShellTrayWindow
                                        PID:1612
                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:17410 /prefetch:2
                                          2⤵
                                            PID:5004
                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                          1⤵
                                          • Suspicious use of FindShellTrayWindow
                                          PID:5000
                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17410 /prefetch:2
                                            2⤵
                                              PID:4944
                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                            1⤵
                                            • Suspicious use of FindShellTrayWindow
                                            PID:4876
                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4876 CREDAT:17410 /prefetch:2
                                              2⤵
                                                PID:3736
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                              1⤵
                                              • Modifies Internet Explorer settings
                                              • Suspicious use of FindShellTrayWindow
                                              PID:1064
                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:17410 /prefetch:2
                                                2⤵
                                                  PID:2632
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                1⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of FindShellTrayWindow
                                                PID:3608
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3608 CREDAT:17410 /prefetch:2
                                                  2⤵
                                                    PID:1404
                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:3872
                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3872 CREDAT:17410 /prefetch:2
                                                    2⤵
                                                      PID:4988
                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:764
                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:764 CREDAT:17410 /prefetch:2
                                                      2⤵
                                                        PID:3744
                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:4248
                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:17410 /prefetch:2
                                                        2⤵
                                                          PID:1988
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:1248
                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:17410 /prefetch:2
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          PID:852
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:4080
                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:17410 /prefetch:2
                                                          2⤵
                                                            PID:1812
                                                        • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                          "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                          1⤵
                                                            PID:4176
                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:2232
                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:17410 /prefetch:2
                                                              2⤵
                                                                PID:4132
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                              1⤵
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:3772
                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3772 CREDAT:17410 /prefetch:2
                                                                2⤵
                                                                  PID:936
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                1⤵
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:4300
                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4300 CREDAT:17410 /prefetch:2
                                                                  2⤵
                                                                    PID:4216
                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                  1⤵
                                                                  • Modifies Internet Explorer settings
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:2536
                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:17410 /prefetch:2
                                                                    2⤵
                                                                      PID:2056
                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                    1⤵
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:2964
                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:17410 /prefetch:2
                                                                      2⤵
                                                                        PID:404
                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                      1⤵
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:4272
                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4272 CREDAT:17410 /prefetch:2
                                                                        2⤵
                                                                          PID:3336
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                        1⤵
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        PID:1936
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:17410 /prefetch:2
                                                                          2⤵
                                                                            PID:3668
                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                          1⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:4620
                                                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4620 CREDAT:17410 /prefetch:2
                                                                            2⤵
                                                                              PID:4688
                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:852
                                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:17410 /prefetch:2
                                                                              2⤵
                                                                                PID:3256
                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:4912
                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4912 CREDAT:17410 /prefetch:2
                                                                                2⤵
                                                                                  PID:1960
                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                1⤵
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:2644
                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:17410 /prefetch:2
                                                                                  2⤵
                                                                                    PID:2200
                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                  1⤵
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:3024
                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:17410 /prefetch:2
                                                                                    2⤵
                                                                                      PID:2532
                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                    1⤵
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:3512
                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3512 CREDAT:17410 /prefetch:2
                                                                                      2⤵
                                                                                        PID:2808
                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:2748
                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:17410 /prefetch:2
                                                                                        2⤵
                                                                                          PID:4408
                                                                                      • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                                                        "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                                                        1⤵
                                                                                          PID:4564
                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                          1⤵
                                                                                          • Modifies Internet Explorer settings
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:5108
                                                                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5108 CREDAT:17410 /prefetch:2
                                                                                            2⤵
                                                                                              PID:2892
                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                            1⤵
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:2728
                                                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:17410 /prefetch:2
                                                                                              2⤵
                                                                                                PID:5072
                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                              1⤵
                                                                                              • Modifies Internet Explorer settings
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              PID:4768
                                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4768 CREDAT:17410 /prefetch:2
                                                                                                2⤵
                                                                                                  PID:920
                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                1⤵
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:4600
                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4600 CREDAT:17410 /prefetch:2
                                                                                                  2⤵
                                                                                                    PID:4932
                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                  1⤵
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  PID:3520
                                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3520 CREDAT:17410 /prefetch:2
                                                                                                    2⤵
                                                                                                      PID:1300
                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                    1⤵
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:716
                                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:716 CREDAT:17410 /prefetch:2
                                                                                                      2⤵
                                                                                                        PID:2000
                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                      1⤵
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      PID:3156
                                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3156 CREDAT:17410 /prefetch:2
                                                                                                        2⤵
                                                                                                          PID:1792
                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                        1⤵
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        PID:4164
                                                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4164 CREDAT:17410 /prefetch:2
                                                                                                          2⤵
                                                                                                            PID:1352
                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          PID:2124
                                                                                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:17410 /prefetch:2
                                                                                                            2⤵
                                                                                                              PID:2056
                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                            1⤵
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            PID:1740
                                                                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:17410 /prefetch:2
                                                                                                              2⤵
                                                                                                              • Modifies Internet Explorer settings
                                                                                                              PID:3872
                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                            1⤵
                                                                                                              PID:3108
                                                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3108 CREDAT:17410 /prefetch:2
                                                                                                                2⤵
                                                                                                                  PID:1592
                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                1⤵
                                                                                                                  PID:2728
                                                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:17410 /prefetch:2
                                                                                                                    2⤵
                                                                                                                      PID:516
                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:4936
                                                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4936 CREDAT:17410 /prefetch:2
                                                                                                                        2⤵
                                                                                                                          PID:2456
                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                        1⤵
                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                        PID:2012
                                                                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:17410 /prefetch:2
                                                                                                                          2⤵
                                                                                                                            PID:1604
                                                                                                                        • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                                                                                          "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:3908
                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:1760
                                                                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:17410 /prefetch:2
                                                                                                                                2⤵
                                                                                                                                  PID:1876
                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                1⤵
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                PID:716
                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:716 CREDAT:17410 /prefetch:2
                                                                                                                                  2⤵
                                                                                                                                    PID:3644
                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:1152
                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:17410 /prefetch:2
                                                                                                                                      2⤵
                                                                                                                                        PID:4200
                                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                      1⤵
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      PID:1352
                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:17410 /prefetch:2
                                                                                                                                        2⤵
                                                                                                                                          PID:3396
                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:4500
                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4500 CREDAT:17410 /prefetch:2
                                                                                                                                            2⤵
                                                                                                                                              PID:3580
                                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:2240
                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:17410 /prefetch:2
                                                                                                                                                2⤵
                                                                                                                                                  PID:440
                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:2112
                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:17410 /prefetch:2
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1976
                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                    PID:2912
                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:17410 /prefetch:2
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      PID:4596
                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                    PID:4460
                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4460 CREDAT:17410 /prefetch:2
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3116
                                                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      PID:2276
                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17410 /prefetch:2
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2472

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GJQPG6SR\dnserror[1]

                                                                                                                                                        Filesize

                                                                                                                                                        2KB

                                                                                                                                                        MD5

                                                                                                                                                        2dc61eb461da1436f5d22bce51425660

                                                                                                                                                        SHA1

                                                                                                                                                        e1b79bcab0f073868079d807faec669596dc46c1

                                                                                                                                                        SHA256

                                                                                                                                                        acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993

                                                                                                                                                        SHA512

                                                                                                                                                        a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GJQPG6SR\down[1]

                                                                                                                                                        Filesize

                                                                                                                                                        748B

                                                                                                                                                        MD5

                                                                                                                                                        c4f558c4c8b56858f15c09037cd6625a

                                                                                                                                                        SHA1

                                                                                                                                                        ee497cc061d6a7a59bb66defea65f9a8145ba240

                                                                                                                                                        SHA256

                                                                                                                                                        39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781

                                                                                                                                                        SHA512

                                                                                                                                                        d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEITGDYC\httpErrorPagesScripts[1]

                                                                                                                                                        Filesize

                                                                                                                                                        11KB

                                                                                                                                                        MD5

                                                                                                                                                        9234071287e637f85d721463c488704c

                                                                                                                                                        SHA1

                                                                                                                                                        cca09b1e0fba38ba29d3972ed8dcecefdef8c152

                                                                                                                                                        SHA256

                                                                                                                                                        65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

                                                                                                                                                        SHA512

                                                                                                                                                        87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XE9C1B9R\NewErrorPageTemplate[2]

                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        dfeabde84792228093a5a270352395b6

                                                                                                                                                        SHA1

                                                                                                                                                        e41258c9576721025926326f76063c2305586f76

                                                                                                                                                        SHA256

                                                                                                                                                        77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

                                                                                                                                                        SHA512

                                                                                                                                                        e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XE9C1B9R\errorPageStrings[1]

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        MD5

                                                                                                                                                        d65ec06f21c379c87040b83cc1abac6b

                                                                                                                                                        SHA1

                                                                                                                                                        208d0a0bb775661758394be7e4afb18357e46c8b

                                                                                                                                                        SHA256

                                                                                                                                                        a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

                                                                                                                                                        SHA512

                                                                                                                                                        8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\~DF5C7E4682DBE9C8F5.TMP

                                                                                                                                                        Filesize

                                                                                                                                                        16KB

                                                                                                                                                        MD5

                                                                                                                                                        7ea8594a7b4228a55082128b5f0ccc2a

                                                                                                                                                        SHA1

                                                                                                                                                        d4277832460af93854bd31ae52950081b2cbcda8

                                                                                                                                                        SHA256

                                                                                                                                                        73358382de145571b38a641934147dd579aa5ed275256e6e54585c7be5487ba8

                                                                                                                                                        SHA512

                                                                                                                                                        1d5481de29ba088033e191fd7b1f509d7188b6ff6ebd7d422ac2434b4bf80bb7f3f6e9ddb84e53ff2cb70ba9f3cb933b079b0a4d95b5782acf09f6b54fac182d

                                                                                                                                                      • memory/4816-1-0x0000000002570000-0x0000000002578000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        32KB

                                                                                                                                                      • memory/4816-0-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        136KB

                                                                                                                                                      • memory/4816-2-0x0000000003840000-0x0000000003850000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB