Analysis
- max time kernel
1270s - max time network
1283s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
16/03/2024, 00:22
General
- Target IDM v.6.4x crack v.18.2.exe
- Size 71KB
- Sample240316-anz3vsfb7w
- SHA256 3205dbb244de8d75be0afb501c4711d126cc877223f81428bf2fc761faadb682
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 60 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 64 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 16 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 15 IoCs
- Suspicious use of AdjustPrivilegeToken 41 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of SendNotifyMessage 18 IoCs
- Suspicious use of SetWindowsHookEx 61 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDM v.6.4x crack v.18.2.exe"C:\Users\Admin\AppData\Local\Temp\IDM v.6.4x crack v.18.2.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.0.933501613\934613359" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e55fc9f1-2b30-46d5-940f-60ee3c231131} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 1980 210e27e6e58 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.1.1922451640\797670568" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fe830fc-7acf-4c6d-801c-2c8dc6d358db} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 2360 210e2330e58 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.2.1308823353\749692801" -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 3180 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12afa5e1-ab26-40e5-a358-d5b17a18c4e2} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3160 210e689b858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.3.350674662\1178576092" -childID 2 -isForBrowser -prefsHandle 2500 -prefMapHandle 1580 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a2c0802-1415-48a9-9ecb-d00bb7537306} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 2496 210d5e72b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.4.680763821\1527686435" -childID 3 -isForBrowser -prefsHandle 3656 -prefMapHandle 3664 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9e1bb3e-ec60-4709-a187-723a8ce950d4} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3768 210e6e7cf58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.5.1963349032\1683379310" -childID 4 -isForBrowser -prefsHandle 4984 -prefMapHandle 4952 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b19b9eb6-cfdb-41fd-9f15-f2d12dd995f8} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 4996 210e6848658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.6.2105427760\849962141" -childID 5 -isForBrowser -prefsHandle 5016 -prefMapHandle 5136 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78e2fb34-3228-4212-bb3a-9340d2005ffd} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 5212 210e8c79b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.7.262396986\1747268809" -childID 6 -isForBrowser -prefsHandle 5360 -prefMapHandle 4916 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d8af1a1-b78b-4880-b2d6-588b71cb9d87} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 5368 210e55fa858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.8.1345999430\1969100983" -childID 7 -isForBrowser -prefsHandle 5828 -prefMapHandle 5824 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61fc1138-c276-433d-9f01-1ef5bdc65247} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3052 210e53cf058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.9.540451038\211947791" -childID 8 -isForBrowser -prefsHandle 1072 -prefMapHandle 1620 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03930521-16b2-4285-9da9-781f2ac9a678} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3472 210e51af858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.10.150097829\1303065463" -childID 9 -isForBrowser -prefsHandle 3628 -prefMapHandle 3716 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {259cbf30-434d-4384-a4ae-dde104a41522} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6068 210d5e63258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.11.852633271\1595238058" -childID 10 -isForBrowser -prefsHandle 5608 -prefMapHandle 3564 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b4922f6-3512-4673-bce1-793ffefe90d9} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 5612 210e26fbd58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.12.1026900469\775132888" -childID 11 -isForBrowser -prefsHandle 6252 -prefMapHandle 3684 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7de1c6e0-b8ce-414a-90f3-3bad9af31dd7} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3980 210ea6de058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.13.563280926\1948166313" -childID 12 -isForBrowser -prefsHandle 6460 -prefMapHandle 6400 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {570bb01f-b5b1-4ea4-960b-d9f88513e293} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6452 210e51b1358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.14.822411484\404500848" -childID 13 -isForBrowser -prefsHandle 6264 -prefMapHandle 5112 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {513a8f5b-6c8f-40ef-85c0-e35f4aad3f41} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6296 210d5e61f58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.15.729569258\1434197948" -childID 14 -isForBrowser -prefsHandle 6432 -prefMapHandle 6424 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91b4364e-b605-41f5-922d-244b0e6a630a} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6428 210e51b1058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.16.728622179\426717127" -childID 15 -isForBrowser -prefsHandle 6556 -prefMapHandle 6544 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a25bec2d-44ee-4266-9972-e9e6ddd88f67} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6488 210e5304458 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.17.1485690455\2004400397" -childID 16 -isForBrowser -prefsHandle 6092 -prefMapHandle 6520 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e4baa15-e844-4fe2-a384-f6e10204d2d6} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6404 210e53b0558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.18.1721470110\1748584938" -childID 17 -isForBrowser -prefsHandle 5124 -prefMapHandle 1068 -prefsLen 27386 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bafd0a2-8b24-45ae-a9d5-de270ec79300} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 4600 210e53b1d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.19.959148269\1318475045" -childID 18 -isForBrowser -prefsHandle 3688 -prefMapHandle 6196 -prefsLen 27386 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88344fc9-481b-43a7-a961-7113471dacee} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6256 210e878b258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.20.659648063\3703873" -childID 19 -isForBrowser -prefsHandle 6188 -prefMapHandle 6588 -prefsLen 27395 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fb50288-896c-477e-960c-218d9ead6bca} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 5132 210d5e71058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.21.103650785\1912342732" -childID 20 -isForBrowser -prefsHandle 6504 -prefMapHandle 4984 -prefsLen 27395 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fe3ba89-cba5-4e4b-a106-aa03ff5c5283} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 6692 210ea6dfe58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.22.1646189462\1123687692" -childID 21 -isForBrowser -prefsHandle 7372 -prefMapHandle 7376 -prefsLen 27395 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3610f3e-9c4b-4406-99a1-c3f94722ee4a} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 7364 210e5168558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.23.118258679\1539744729" -childID 22 -isForBrowser -prefsHandle 7716 -prefMapHandle 7724 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73812442-887d-4a26-b816-04968fe4eb86} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 7708 210d5e68d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.24.1662645018\1089186762" -childID 23 -isForBrowser -prefsHandle 7304 -prefMapHandle 7420 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03d806c4-ebbe-48e4-94a2-4258b81691d6} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 1636 210e5078a58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.25.1538854068\1213868253" -childID 24 -isForBrowser -prefsHandle 6048 -prefMapHandle 3376 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5debb9d9-e1f4-42b2-acf7-3bf74410f468} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 4756 210ed47f158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.26.507691781\2141235902" -childID 25 -isForBrowser -prefsHandle 7764 -prefMapHandle 4944 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff21e490-2a88-4e70-ba67-bd67fe938e45} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 7836 210ed5bf858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.27.1796338985\821583311" -childID 26 -isForBrowser -prefsHandle 7300 -prefMapHandle 6196 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aaf00fe-031a-4bf0-ae90-e7c7f890b5f2} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3644 210e5078a58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.28.921750748\1017226441" -childID 27 -isForBrowser -prefsHandle 3040 -prefMapHandle 3624 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd58d843-1e1b-4805-a9b3-9303667a5a0c} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 7536 210efc96858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.29.1384171651\206184372" -childID 28 -isForBrowser -prefsHandle 4580 -prefMapHandle 7024 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed9cab24-a901-49e9-8e64-f1b79cd16586} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 4644 210efc95058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.30.1345012124\58778489" -childID 29 -isForBrowser -prefsHandle 3400 -prefMapHandle 7284 -prefsLen 27483 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e65816b7-0235-4d26-aae2-ddd6717c67aa} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 7896 210efc94158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.31.1115431107\1791533434" -childID 30 -isForBrowser -prefsHandle 7756 -prefMapHandle 7156 -prefsLen 27492 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1e40184-7480-4fd0-a5f3-957b10891f23} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 11888 210ed495958 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.32.1546045946\1543351642" -childID 31 -isForBrowser -prefsHandle 7176 -prefMapHandle 6832 -prefsLen 27492 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e36f3d8-196f-461a-aee1-8959456dbdb1} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 11816 210ef6e0558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.33.881199021\1196497632" -childID 32 -isForBrowser -prefsHandle 7296 -prefMapHandle 5132 -prefsLen 27492 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {058cfef4-6f86-47f5-b248-48740541915d} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 1160 210ef6e0858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.34.1162642870\1771122719" -childID 33 -isForBrowser -prefsHandle 6620 -prefMapHandle 11872 -prefsLen 27492 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40359d90-8a64-4aa9-8850-cc721955c0ac} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 11732 210ef6e1d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5068.35.700879299\164898679" -childID 34 -isForBrowser -prefsHandle 6440 -prefMapHandle 7360 -prefsLen 27492 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4edc3e5d-2b60-4419-b4e5-e2cbae8ce9b6} 5068 "\\.\pipe\gecko-crash-server-pipe.5068" 3644 210ef5d1558 tab3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23380:116:7zEvent99541⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\IDM v6.42.3 By IDMLover.com\idman642build3.exe"C:\Users\Admin\Downloads\IDM v6.42.3 By IDMLover.com\idman642build3.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html5⤵
- Checks processor information in registry
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3656 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3632 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5096 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3fa3669a-cfb5-c340-82db-feba63da85ba}\idmwfp.inf" "9" "4fc2928b3" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Internet Download Manager"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000015C" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000160" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000174" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\IDM v6.42.3 By IDMLover.com\IDMLover_Patch_v18.2\IDM v.6.4x crack v.18.2.exe"C:\Users\Admin\Downloads\IDM v6.42.3 By IDMLover.com\IDMLover_Patch_v18.2\IDM v.6.4x crack v.18.2.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\IDM_BAK.vbs" /idmdir:"C:\Program Files (x86)\Internet Download Manager\"2⤵
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\IDM_REG.vbs"2⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /IM IDMan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UnSigner.exe"C:\Users\Admin\AppData\Local\Temp\UnSigner.exe" -f -b "C:\Program Files (x86)\Internet Download Manager\IDMan.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c whoami /user /fo list3⤵
-
C:\Windows\SysWOW64\whoami.exewhoami /user /fo list4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\reg.exereg query HKU\S-1-5-193⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Internet Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Internet Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Internet Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Wow6432Node\Internet Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Wow6432Node\Internet Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Wow6432Node\Internet Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Wow6432Node\Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Wow6432Node\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Wow6432Node\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\DownloadManager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Wow6432Node\DownloadManager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Wow6432Node\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Wow6432Node\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Wow6432Node\Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Wow6432Node\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Wow6432Node\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Wow6432Node\DownloadManager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Wow6432Node\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Wow6432Node\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Wow6432Node\Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Wow6432Node\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Wow6432Node\Download Manager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\DownloadManager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Wow6432Node\DownloadManager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Wow6432Node\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Wow6432Node\DownloadManager"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Internet Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Wow6432Node\Internet Download Manager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Wow6432Node\DownloadManager" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "Email" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "Serial" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "CheckUpdtVM" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "tvfrdt" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "LstCheck" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "scansk" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "radxcnt" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "ptrk_scdt" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "LastCheckQU" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LaunchOnStart" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Registered to:" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d "Admin" /f3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell write-host '.::' -fore '"Red"' -NoNewline; write-host ' Please don''t forget to' -fore '"White"' -NoNewline; write-host ' re-register IDM' -fore '"Green"' -NoNewline; write-host ' !' -fore '"White"' -NoNewline; write-host ' ::.' -fore '"Red"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\IDM_REG.vbs"2⤵
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\IDM_SPPEDUP.vbs" /SpeedUP:12⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /select,C:\Program Files (x86)\Internet Download Manager\IDMan.exe2⤵
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf4⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\IDM v6.42.3 By IDMLover.com\IDMLover_Patch_v18.2\IDM v.6.4x crack v.18.2.exe"C:\Users\Admin\Downloads\IDM v6.42.3 By IDMLover.com\IDMLover_Patch_v18.2\IDM v.6.4x crack v.18.2.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\IDM_BAK.vbs" /idmdir:"C:\Program Files (x86)\Internet Download Manager\"2⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /select,C:\Program Files (x86)\Internet Download Manager\IDMan.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap6023:100:7zEvent32487 -ad -saa -- "C:\Program Files (x86)\Internet Download Manager"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
IDMGetAll.dll
IDMGetAll64.dll
IDMIECC.dll
IDMIECC64.dll
IDMIECC64.dll
IDMIECC64.dll
IDMNetMon64.dll
IDMShellExt64.dll
IDMShellExt64.dll
IDMan.exe
MediumILStart.exe
downlWithIDM.dll
downlWithIDM64.dll
downlWithIDM64.dll
idmBroker.exe
idmfsa.dll
idmnmcl.dll
idmvs.dll
ExplorerStartupLog_RunOnce.etl
10340
11072
11358
12384
13534
13920
18835
22711
23138
2314
24318
24853
25243
25328
26529
27975
30280
30971
32428
4200
4462
0301E86BCDB18CE0C45A536C9B5EE2966DF9E04C
03EAB8E1C3D562117FEE022AAFE46C3F628E2232
070F80A77B44BBA878F282E7DE707BB79469D6D2
152689DBC356073C6853654AF8B1E5255518D588
158BA581BC7785112E67B69836789FF3D762E0F2
276E1FFB0A538F006352776AD2DDB7023A98A614
2C086EFFA9A775BA0015E0F97D3404887A2701C0
2C8D3F74A5BFE7485C5ADC5307C9BB3672D43E0A
300BA2ACD37E9349E0F57EACA8CD6CE923C545C8
31515A9B67C509A95229F8766DCE1C38802CFAF6
32418E28F681302A44555862110316597B0112DA
35DC7DFE3B9B005280A2BA00211FF2458BBF0F5E
3C4E6F3468C3067FADB57B0ED58D21120C642C20
3FF2C394933B915307E49CBAA652A213600C7779
41B95E99CB219B51F19B38D198697E8CD11CCFBC
43DA460BC51036518D5A62234A28229793BC5D65
46AEDE65C03F0E117DDAA403E450FBB17F8E9475
4AD70004B86B308755B53CFA109E57F063AA8E68
5DCAE8B2FE39F98B9F3132B828720075512A4D9D
7377AF10DA4CDECF4B010051F11AD2FD625C7CC5
7B69F0F50092617527F26079E97F33FDC67F9228
7E15DE406C89B3B28ECB351AD1D5095B5F7725A0
869CB939B9B813166BF7A623308DCA7CDEDA263A
889A4D9091632657DFEF85558046FD1328A118C7
893F7740C746BABA522DF36AE5B36F687EA7BFCB
8F0690EC0F2CEA12E7C2AF83A3BC5E7A3AD1BE8D
9120C92C5A6ADFD5DFD1D5BD4E0C87FCE7DFE4A7
92D3D91D8A0E28A418AE06E0F68119EBDF1C764C
96CEFF46F517C610F6B1B4F0025627F0281EFE5F
97E6F3A1853740CF6465250F9A5F3CB3E91D566B
9BA80E6AAE055BD4C5B4DC15C139F15F12F90B8A
AA134219C628E23C3155E342047AB335DD985FAD
ABD810EC2030EA042661B327215A390D1652E532
B1C91D41F66852E5808F33B88C12D55FB8123F4F
B6001495C1594C6979D11B63AF24F3CC3DAD4611
BAD99037B7B3164F6DA27340C5E93D46ACB79481
BAEE354316F6212D63AA7DF5AC6FEBB2B459B06B
BB0B514C1969ACA7BABFC3AA4BEAE40D4F99007A
BEDDAA2FCD8025B500FF7818776B85438F6AB30E
C247B428F72F7A5E89DC2D0BA56ABCBAC7AAC699
C885B4AE5185B7D4729B1D34227817E36667B52C
CAC951E89AA967DB711CA9DFDE2DD14343E07825
D015CEAE4BDFC201B73A3FBDCBB39DE4669B713A
D5650BDDC7D2D6AFBA6BD6ACA9BA8A3755A5011D
DAC63BE070DAB639A18FF75669EA3B3CBC3DC8AF
DBB5CD21943A4A5DC7990F120DA75E5C18F1F3A9
DCABC92AE81F3D42C846A7DEF0904A04BC366AF3
ED53DA796C276431E8CACE7E4B3F7845C9D1FFA9
EF0367443A107783179A7AAA52E70BA0841669A7
F01C3354E3F728C5C1169E434F2C5AC206ABDD67
F42EDBFFBC525232569C2ACEC75487228F9BA893
F4AE3BC3D7A599681F9499CC7B03E306CC95D254
F868AAACEE7971A2D407846B49EB3EDF65C71E7A
F9FCD214A6BAA2879E976488B9C6D13D67A33B69
IDMRegClean.reg
IDM_BAK.vbs
IDM_REG.vbs
IDM1.tmp
IDMSetup2.log
UnSigner.exe
__PSScriptPolicyTest_ty3gmcug.hm1.ps1
tmpaddon
tmpaddon-1
idmwfp64.sys
idmwfp.inf
s_1.dt
defextmap.dat
urlexclist.dat
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms~RFe60af9d.TMP
AlternateServices.txt
SiteSecurityServiceState.txt
addonStartup.json.lz4
broadcast-listeners.json
data.safe.bin
0d0c8773-cafa-4994-b536-47553b26a4f8
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE.txt
manifest.json
widevinecdm.dll
widevinecdm.dll.lib
widevinecdm.dll.sig
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
.padding
{897644af-3328-439e-9c2d-19e139375672}.final
{eaf01923-2441-4d6a-a961-73760bd78873}.final
{6c0b78dd-25a6-428c-8ed2-aba709f6a49c}.final
{f4eb9e44-670e-4198-ad2a-7d65fdf2f813}.final
{30da3410-d2e3-4574-bb8b-389bfbf1a201}.final
{fceb14a2-eb72-4326-9f11-85c34c2c2620}.final
{de52a9b3-74e9-4ccd-a7b3-8e8ba052ca33}.final
{ade7804e-ae1a-4890-9ea2-47032f2dad3c}.final
targeting.snapshot.json
xulstore.json
IDM v6.42.3 By IDMLover.com.rar
IDM v.6.4x crack v.18.2.exe
idman642build3.exe
IDM v6.BNv8jhsh.42.3 By IDMLover.com.rar.part
SETEC1F.tmp
memory/1952-1150-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1111-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1170-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1157-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1124-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1096-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1184-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1952-1087-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3776-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4036-784-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4036-338-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4688-1182-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5332-1123-0x0000000000400000-0x000000000040A000-memory.dmp
memory/5332-1120-0x0000000000400000-0x000000000040A000-memory.dmp
memory/5640-334-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5640-339-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5640-336-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5716-1061-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5716-927-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5820-1144-0x0000000006320000-0x000000000633E000-memory.dmp
memory/5820-1152-0x0000000007DC0000-0x000000000843A000-memory.dmp
memory/5820-1143-0x0000000005E40000-0x0000000006194000-memory.dmp
memory/5820-1128-0x0000000002A80000-0x0000000002A90000-memory.dmp
memory/5820-1132-0x0000000005C60000-0x0000000005CC6000-memory.dmp
memory/5820-1145-0x0000000006360000-0x00000000063AC000-memory.dmp
memory/5820-1126-0x00000000029F0000-0x0000000002A26000-memory.dmp
memory/5820-1127-0x00000000726F0000-0x0000000072EA0000-memory.dmp
memory/5820-1151-0x0000000002A80000-0x0000000002A90000-memory.dmp
memory/5820-1129-0x0000000002A80000-0x0000000002A90000-memory.dmp
memory/5820-1153-0x0000000006800000-0x000000000681A000-memory.dmp
memory/5820-1156-0x00000000726F0000-0x0000000072EA0000-memory.dmp
memory/5820-1131-0x0000000005440000-0x0000000005462000-memory.dmp
memory/5820-1130-0x0000000005490000-0x0000000005AB8000-memory.dmp
memory/5820-1133-0x0000000005CD0000-0x0000000005D36000-memory.dmp
memory/5924-1082-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6124-1196-0x0000000000400000-0x0000000000417000-memory.dmp