Analysis
- max time kernel
126s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/02/2024, 11:42
General
- Target 7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe
- Size 9.4MB
- Sample240229-nvfjpafh2x
- SHA256 7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 9 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 18 IoCs
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 46 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 18 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 30 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe"C:\Users\Admin\AppData\Local\Temp\7b47f6be3dd0a6dcfc80d073bae03dbc95d3c633e14df1eff3bc3bc6049a0c4a.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\System\IDMs.exe"C:\Program Files (x86)\Common Files\System\IDMs.exe" /S /EN /ND2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh.exe advfirewall firewall delete rule name="all" remoteip=95.141.193.1333⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\route.exeroute.exe delete 95.141.193.1333⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsq3068.tmp\Activate.cmd" /res"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsq3068.tmp\Activate.cmd" /res"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "6⤵
-
-
C:\Windows\System32\cmd.execmd6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\DownloadManager" /v ExePath 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" /v ExePath6⤵
-
-
-
C:\Windows\System32\reg.exereg query HKU\S-1-5-195⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\Hardware\Description\System\CentralProcessor\0" /v "Identifier"5⤵
- Checks processor information in registry
-
-
C:\Windows\System32\find.exefind /i "x86"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "FName"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "FName" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LName"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "LName" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "LstCheck" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "(gc C:\Windows\Temp\regdata.txt) -replace 'HKEY_CURRENT_USER', 'HKCU' | Out-File -encoding ASCII C:\Windows\Temp\regdata.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {018D5C66-4533-4307-9B53-224DE2ED1FE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {20894375-46AE-46E2-BAFD-CB38975CDCE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {389510b7-9e58-40d7-98bf-60b911cb0ea9}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5999E1EE-711E-48D2-9884-851A709F543D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5AB7172C-9C11-405C-8DD5-AF20F3606282}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7AFDFDDB-F914-11E4-8377-6C3BE50D980C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7B37E4E2-C62F-4914-9620-8FB5062718CC}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {917E8742-AA3B-7318-FA12-10485FB322A2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {94269C4E-071A-4116-90E6-52E557067E4E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9489FEB2-1925-4D01-B788-6D912C70F7F2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9AA2F32D-362A-42D9-9328-24A483E2CCC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A78ED123-AB77-406B-9962-2A5D9D2F7F30}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A926714B-7BFC-4D08-A035-80021395FFA8}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {AB807329-7324-431B-8B36-DBD581F56E0B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {BBACC218-34EA-4666-9D7A-C78F2274A524}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {F241C880-6982-4CE5-8CF7-7085BA96DA5A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\System32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsq3068.tmp\Activate.cmd" /act"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsq3068.tmp\Activate.cmd" /act"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "6⤵
-
-
C:\Windows\System32\cmd.execmd6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\DownloadManager" /v ExePath 2>nul5⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" /v ExePath6⤵
-
-
-
C:\Windows\System32\reg.exereg query HKU\S-1-5-195⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\Hardware\Description\System\CentralProcessor\0" /v "Identifier"5⤵
- Checks processor information in registry
-
-
C:\Windows\System32\find.exefind /i "x86"5⤵
-
-
C:\Windows\System32\PING.EXEping -n 1 internetdownloadmanager.com5⤵
- Runs ping.exe
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq idman.exe"5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\findstr.exefindstr /i "idman.exe"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "FName"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LName"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "(gc C:\Windows\Temp\regdata.txt) -replace 'HKEY_CURRENT_USER', 'HKCU' | Out-File -encoding ASCII C:\Windows\Temp\regdata.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {018D5C66-4533-4307-9B53-224DE2ED1FE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {20894375-46AE-46E2-BAFD-CB38975CDCE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {389510b7-9e58-40d7-98bf-60b911cb0ea9}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5999E1EE-711E-48D2-9884-851A709F543D}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5AB7172C-9C11-405C-8DD5-AF20F3606282}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7AFDFDDB-F914-11E4-8377-6C3BE50D980C}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7B37E4E2-C62F-4914-9620-8FB5062718CC}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {917E8742-AA3B-7318-FA12-10485FB322A2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {94269C4E-071A-4116-90E6-52E557067E4E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9489FEB2-1925-4D01-B788-6D912C70F7F2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9AA2F32D-362A-42D9-9328-24A483E2CCC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A78ED123-AB77-406B-9962-2A5D9D2F7F30}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A926714B-7BFC-4D08-A035-80021395FFA8}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {AB807329-7324-431B-8B36-DBD581F56E0B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {BBACC218-34EA-4666-9D7A-C78F2274A524}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {F241C880-6982-4CE5-8CF7-7085BA96DA5A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\DownloadManager /v FName /t REG_SZ /d "Tonec FZE"5⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\DownloadManager /v LName /t REG_SZ /d ""5⤵
-
-
C:\Windows\System32\reg.exe
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\DownloadManager /v Serial /t REG_SZ /d "FOX6H-3KWH4-7TSIN-Q4US7"5⤵
- Modifies registry key
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq idman.exe"5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\findstr.exefindstr /i "idman.exe"5⤵
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/register/IDMlib/images/idman_logos.png" /p "C:\Windows\Temp" /f temp.png5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe"C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe" -runcm6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf7⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r8⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o9⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"8⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /ve6⤵
- Modifies registry key
-
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/register/IDMlib/images/idman_logos.png" /p "C:\Windows\Temp" /f temp.png5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "(gc C:\Windows\Temp\regdata.txt) -replace 'HKEY_CURRENT_USER', 'HKCU' | Out-File -encoding ASCII C:\Windows\Temp\regdata.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {018D5C66-4533-4307-9B53-224DE2ED1FE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {20894375-46AE-46E2-BAFD-CB38975CDCE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {389510b7-9e58-40d7-98bf-60b911cb0ea9}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {53780901-3955-2ef4-f324-3f8dfbb7813a}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a}5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /ve6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo (Default) REG_SZ 62"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r /e "[^0-9]"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {544506d2-97af-72ad-36f4-77e27e657a21}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21}5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5999E1EE-711E-48D2-9884-851A709F543D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5AB7172C-9C11-405C-8DD5-AF20F3606282}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {79873CC5-3951-43ED-BDF9-D8759474B6FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /ve 2>nul5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo (Default) REG_SZ (value not set)"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r /e "[^0-9]"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Version /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Version /ve6⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Model"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "MData Model scansk Therad"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7AFDFDDB-F914-11E4-8377-6C3BE50D980C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7B37E4E2-C62F-4914-9620-8FB5062718CC}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {917E8742-AA3B-7318-FA12-10485FB322A2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {94269C4E-071A-4116-90E6-52E557067E4E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9489FEB2-1925-4D01-B788-6D912C70F7F2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9AA2F32D-362A-42D9-9328-24A483E2CCC3}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A78ED123-AB77-406B-9962-2A5D9D2F7F30}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A926714B-7BFC-4D08-A035-80021395FFA8}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}5⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {AB807329-7324-431B-8B36-DBD581F56E0B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {BBACC218-34EA-4666-9D7A-C78F2274A524}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {E6871B76-C3C8-44DD-B947-ABFFE144860D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {F241C880-6982-4CE5-8CF7-7085BA96DA5A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/register/IDMlib/images/idman_logos.png" /p "C:\Windows\Temp" /f temp.png5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}5⤵
- Modifies registry key
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/register/IDMlib/images/idman_logos.png" /p "C:\Windows\Temp" /f temp.png5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "(gc C:\Windows\Temp\regdata.txt) -replace 'HKEY_CURRENT_USER', 'HKCU' | Out-File -encoding ASCII C:\Windows\Temp\regdata.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {018D5C66-4533-4307-9B53-224DE2ED1FE6}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {20894375-46AE-46E2-BAFD-CB38975CDCE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {389510b7-9e58-40d7-98bf-60b911cb0ea9}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {53780901-3955-2ef4-f324-3f8dfbb7813a}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /ve6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo (Default) REG_SZ 62"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r /e "[^0-9]"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {544506d2-97af-72ad-36f4-77e27e657a21}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5999E1EE-711E-48D2-9884-851A709F543D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5AB7172C-9C11-405C-8DD5-AF20F3606282}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {79873CC5-3951-43ED-BDF9-D8759474B6FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /ve6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo (Default) REG_SZ (value not set)"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r /e "[^0-9]"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Version /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Version /ve6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}6⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Model"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "MData Model scansk Therad"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7AFDFDDB-F914-11E4-8377-6C3BE50D980C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7B37E4E2-C62F-4914-9620-8FB5062718CC}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {917E8742-AA3B-7318-FA12-10485FB322A2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {94269C4E-071A-4116-90E6-52E557067E4E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9489FEB2-1925-4D01-B788-6D912C70F7F2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9AA2F32D-362A-42D9-9328-24A483E2CCC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A78ED123-AB77-406B-9962-2A5D9D2F7F30}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A926714B-7BFC-4D08-A035-80021395FFA8}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {AB807329-7324-431B-8B36-DBD581F56E0B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {BBACC218-34EA-4666-9D7A-C78F2274A524}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {E6871B76-C3C8-44DD-B947-ABFFE144860D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {F241C880-6982-4CE5-8CF7-7085BA96DA5A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq idman.exe"5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\findstr.exefindstr /i "idman.exe"5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im idman.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "FName"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "FName" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LName"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "LName" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "Email" /f5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "Serial" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "radxcnt" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKCU\Software\DownloadManager" "/v" "LstCheck" /f5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"5⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "(gc C:\Windows\Temp\regdata.txt) -replace 'HKEY_CURRENT_USER', 'HKCU' | Out-File -encoding ASCII C:\Windows\Temp\regdata.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {018D5C66-4533-4307-9B53-224DE2ED1FE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {20894375-46AE-46E2-BAFD-CB38975CDCE6}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\System32\reg.exereg delete HKCU\Software\Classes\Wow6432Node\CLSID\{27cb9b1f-3bb1-68ae-6a40-e868dae1dec1} /f5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {389510b7-9e58-40d7-98bf-60b911cb0ea9}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}5⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {53780901-3955-2ef4-f324-3f8dfbb7813a}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a}5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /ve6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo (Default) REG_SZ 62"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r /e "[^0-9]"5⤵
-
-
C:\Windows\System32\reg.exereg delete HKCU\Software\Classes\Wow6432Node\CLSID\{53780901-3955-2ef4-f324-3f8dfbb7813a} /f5⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {544506d2-97af-72ad-36f4-77e27e657a21}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\System32\reg.exereg delete HKCU\Software\Classes\Wow6432Node\CLSID\{544506d2-97af-72ad-36f4-77e27e657a21} /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5999E1EE-711E-48D2-9884-851A709F543D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {5AB7172C-9C11-405C-8DD5-AF20F3606282}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {79873CC5-3951-43ED-BDF9-D8759474B6FD}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /ve6⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo (Default) REG_SZ (value not set)"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r /e "[^0-9]"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Version /ve 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Version /ve6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2>nul5⤵
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Model"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "MData Model scansk Therad"5⤵
-
-
C:\Windows\System32\reg.exereg delete HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7AFDFDDB-F914-11E4-8377-6C3BE50D980C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {7B37E4E2-C62F-4914-9620-8FB5062718CC}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {917E8742-AA3B-7318-FA12-10485FB322A2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {94269C4E-071A-4116-90E6-52E557067E4E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9489FEB2-1925-4D01-B788-6D912C70F7F2}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {9AA2F32D-362A-42D9-9328-24A483E2CCC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A78ED123-AB77-406B-9962-2A5D9D2F7F30}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {A926714B-7BFC-4D08-A035-80021395FFA8}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {AB807329-7324-431B-8B36-DBD581F56E0B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {BBACC218-34EA-4666-9D7A-C78F2274A524}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {E6871B76-C3C8-44DD-B947-ABFFE144860D}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}5⤵
-
-
C:\Windows\System32\find.exefind /i "H"5⤵
-
-
C:\Windows\System32\reg.exereg delete HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo {F241C880-6982-4CE5-8CF7-7085BA96DA5A}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKCU\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "LocalServer32 InProcServer32 InProcHandler32"5⤵
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f5⤵
-
-
C:\Windows\System32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Registers COM server for autorun
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf4⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Registers COM server for autorun
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
idmwfp64.sys
IDMs.exe
IDMs.exe
IDMGetAll64.dll
IDMIECC64.dll
IDMNetMon64.dll
IDMShellExt64.dll
IDMan.exe
idm_am.lng
idm_ar.lng
idm_chn2.lng
idm_cht.lng
idm_cz.lng
idm_de.lng
idm_es.lng
idm_fa.lng
idm_fr.lng
idm_ge.lng
idm_gr.lng
idm_hu.lng
idm_id.lng
idm_it.lng
idm_iw.lng
idm_jp.lng
idm_kr.lng
Uninstall.exe
downlWithIDM64.dll
idmBroker.exe
idmcchandler2.dll
idmcchandler2_64.dll
idmvs.dll
idmwfp.inf
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_skaeaqnh.jby.ps1
aut2D69.tmp
Activate.cmd
ExecDos.dll
NewTextreplace.dll
System.dll
inetc.dll
nsExec.dll
registry.dll
1709207011f1
log_0.log
regdata.txt
regdata.txt
temp.png
memory/748-617-0x00007FFC2B1C0000-0x00007FFC2BC81000-memory.dmp
memory/748-613-0x000001D7755C0000-0x000001D7755D0000-memory.dmp
memory/748-614-0x000001D7755C0000-0x000001D7755D0000-memory.dmp
memory/748-608-0x00007FFC2B1C0000-0x00007FFC2BC81000-memory.dmp
memory/1580-420-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2016-667-0x00007FFC2B1C0000-0x00007FFC2BC81000-memory.dmp
memory/2016-653-0x00007FFC2B1C0000-0x00007FFC2BC81000-memory.dmp
memory/2016-663-0x0000020AF0C30000-0x0000020AF0C40000-memory.dmp
memory/2016-664-0x0000020AF0C30000-0x0000020AF0C40000-memory.dmp
memory/2160-729-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2160-716-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3964-679-0x000002227DC10000-0x000002227DC20000-memory.dmp
memory/3964-678-0x00007FFC2B1C0000-0x00007FFC2BC81000-memory.dmp
memory/3964-682-0x00007FFC2B1C0000-0x00007FFC2BC81000-memory.dmp
memory/4820-473-0x000002056DEC0000-0x000002056DED0000-memory.dmp
memory/4820-463-0x000002056DEC0000-0x000002056DED0000-memory.dmp
memory/4820-478-0x00007FFC2BDA0000-0x00007FFC2C861000-memory.dmp
memory/4820-462-0x00007FFC2BDA0000-0x00007FFC2C861000-memory.dmp
memory/4916-0-0x00000000007A0000-0x0000000001112000-memory.dmp
memory/4932-544-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4932-533-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5020-448-0x00007FFC2BB90000-0x00007FFC2C651000-memory.dmp
memory/5020-455-0x00007FFC2BB90000-0x00007FFC2C651000-memory.dmp
memory/5020-450-0x00000237DDAD0000-0x00000237DDAE0000-memory.dmp
memory/5020-447-0x00000237DFDF0000-0x00000237DFE12000-memory.dmp
memory/5020-449-0x00000237DDAD0000-0x00000237DDAE0000-memory.dmp