168caeccc25258b81c9cc6d43df8de2fd55bb3c9329b7cb423112cd56a5cb6b5

Analysis

max time kernel
133s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDM/!)̻.bat
Size

12KB
MD5

5b0a72e2ac8c39673e3de1422eed8f2b
SHA1

59a4b36e31445a372f6daacd018ad4f848b00eb4
SHA256

45b98fe4656eec3c6d46f22a9eb878729302445175cea46f86c98bd61cdfd676
SHA512

0a1c861f5c88da496496f1971967c69f3986bcc19d2880aafa2d6337105020e2dff5f960036bff96e53cb38002c5c27daa16b327cabf64ba3cb6511f3e78b230
SSDEEP

192:9v1gvPKbivUXiT5hX+TQjWvN2W00h5l8/AAQ/AA7/AAla4jc3j:DeRW0xAL44o3j

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET6FA4.tmp	RUNDLL32.EXE
File created	C:\Windows\system32\DRIVERS\SET6FA4.tmp	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\idmwfp.sys	RUNDLL32.EXE

Registers COM server for autorun 1 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDMIECC64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDMShellExt64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDMIECC64.dll"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDMShellExt64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDMShellExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDMGetAll64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	RUNDLL32.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1072	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1136	taskkill.exe
2564	taskkill.exe
2992	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\使用 IDM 下载全部链接	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}	idmBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\Policy = "3"	idmBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\使用 IDM 下载\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IEExt.htm"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\使用 IDM 下载全部链接\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IEGetAll.htm"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	idmBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\使用 IDM 下载全部链接\contexts = "243"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\使用 IDM 下载	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM"	idmBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\使用 IDM 下载\contexts = "243"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights	idmBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppName = "idmBroker.exe"	idmBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356E6235-B055-46D9-8B32-BDC2266C9DAB}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356E6235-B055-46D9-8B32-BDC2266C9DAB}\TypeLib\ = "{6A89524B-E1B6-4D71-972A-8FD53F240936}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC69364C-34D7-4225-B16F-8595C743C775}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}\TypeLib	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMIEHlprObj\ = "IDMIEHlprObj Class"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage.1\CLSID	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\CurVer\ = "DownlWithIDM.V2LinkProcessor.1"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BDFC55C-ED33-43BB-9A77-57C2AF4B56EF}\1.0	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}\TypeLib\Version = "1.0"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\ = "LinkProcessor Class"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.IDMDwnlMgr\CurVer\ = "DownlWithIDM.IDMDwnlMgr.1"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\IDManTypeInfo.tlb"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}\TypeLib\Version = "1.0"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}\ProxyStubClsid32	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\ProgID	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\FLAGS	idmBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage\CurVer\ = "IDMIECC.IDMHelperLinksStorage.1"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37294E01-DB54-43AF-9D50-93FF7267DF5D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Control	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72B7361C-3568-4392-BCCD-D912CD5C1169}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.VLinkProcessor\CurVer\ = "DownlWithIDM.VLinkProcessor.1"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\ProgID\ = "Idmfsa.IDMEFSAgent.1"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\VersionIndependentProgID\ = "idmBroker.OptionsReader"	idmBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib\ = "{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}"	idmBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\CurVer\ = "DownlWithIDM.V2LinkProcessor.1"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\ = "IIDMEFSAgent7"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33AEF752-FB86-4787-9ED1-6010528F5FA3}\TypeLib\ = "{37294E01-DB54-43AF-9D50-93FF7267DF5D}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.VLinkProcessor\CurVer\ = "DownlWithIDM.VLinkProcessor.1"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\ = "V2LinkProcessor Class"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BC69364C-34D7-4225-B16F-8595C743C775}\ = "IVLinkProcessor"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}\NumMethods\ = "13"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1\ = "OptionsReader Class"	idmBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage.1	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\ProgID	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\MiscStatus\1\ = "131473"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}\TypeLib\Version = "1.0"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\ = "V2LinkProcessor Class"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\VersionIndependentProgID	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0	idmBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMGetAll.IDMAllLinksProcessor.1\ = "IDMAllLinksProcessor Class"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.IDMDwnlMgr\CLSID	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\AppId = "{0F947660-8606-420A-BAC6-51B84DD22A47}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ = "IOptionsReader"	idmBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{356E6235-B055-46D9-8B32-BDC2266C9DAB}\ = "ILinkProcessor"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\VersionIndependentProgID	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Version	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}\ = "IIDMEFSAgent3"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Idmfsa.IDMEFSAgent\CurVer	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0F947660-8606-420A-BAC6-51B84DD22A47}\DllSurrogate	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor.1\ = "V2LinkProcessor Class"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}\ProxyStubClsid32	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\ = "LinkProcessor Class"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage.1\CLSID\ = "{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.IDMDwnlMgr.1\ = "IDMDwnlMgr Class"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72B7361C-3568-4392-BCCD-D912CD5C1169}\TypeLib\ = "{6A89524B-E1B6-4D71-972A-8FD53F240936}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMGetAll.IDMAllLinksProcessor.1\CLSID\ = "{5312C54E-A385-46B7-B200-ABAF81B03935}"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\ProgID\ = "DownlWithIDM.IDMDwnlMgr.1"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\ = "OptionsReader Class"	idmBroker.exe

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1092	idmBroker.exe
2248	IDMan.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	IDMan.exe
2248	IDMan.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2608	WMIC.exe
Token: SeSecurityPrivilege	2608	WMIC.exe
Token: SeTakeOwnershipPrivilege	2608	WMIC.exe
Token: SeLoadDriverPrivilege	2608	WMIC.exe
Token: SeSystemProfilePrivilege	2608	WMIC.exe
Token: SeSystemtimePrivilege	2608	WMIC.exe
Token: SeProfSingleProcessPrivilege	2608	WMIC.exe
Token: SeIncBasePriorityPrivilege	2608	WMIC.exe
Token: SeCreatePagefilePrivilege	2608	WMIC.exe
Token: SeBackupPrivilege	2608	WMIC.exe
Token: SeRestorePrivilege	2608	WMIC.exe
Token: SeShutdownPrivilege	2608	WMIC.exe
Token: SeDebugPrivilege	2608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2608	WMIC.exe
Token: SeRemoteShutdownPrivilege	2608	WMIC.exe
Token: SeUndockPrivilege	2608	WMIC.exe
Token: SeManageVolumePrivilege	2608	WMIC.exe
Token: 33	2608	WMIC.exe
Token: 34	2608	WMIC.exe
Token: 35	2608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2608	WMIC.exe
Token: SeSecurityPrivilege	2608	WMIC.exe
Token: SeTakeOwnershipPrivilege	2608	WMIC.exe
Token: SeLoadDriverPrivilege	2608	WMIC.exe
Token: SeSystemProfilePrivilege	2608	WMIC.exe
Token: SeSystemtimePrivilege	2608	WMIC.exe
Token: SeProfSingleProcessPrivilege	2608	WMIC.exe
Token: SeIncBasePriorityPrivilege	2608	WMIC.exe
Token: SeCreatePagefilePrivilege	2608	WMIC.exe
Token: SeBackupPrivilege	2608	WMIC.exe
Token: SeRestorePrivilege	2608	WMIC.exe
Token: SeShutdownPrivilege	2608	WMIC.exe
Token: SeDebugPrivilege	2608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2608	WMIC.exe
Token: SeRemoteShutdownPrivilege	2608	WMIC.exe
Token: SeUndockPrivilege	2608	WMIC.exe
Token: SeManageVolumePrivilege	2608	WMIC.exe
Token: 33	2608	WMIC.exe
Token: 34	2608	WMIC.exe
Token: 35	2608	WMIC.exe
Token: SeRestorePrivilege	2248	IDMan.exe
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeRestorePrivilege	2932	RUNDLL32.EXE
Token: SeBackupPrivilege	2248	IDMan.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2248	IDMan.exe
2248	IDMan.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2248	IDMan.exe
2248	IDMan.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2248	IDMan.exe
2248	IDMan.exe
2248	IDMan.exe
2248	IDMan.exe
2248	IDMan.exe
1560	IDMIntegrator64.exe
1560	IDMIntegrator64.exe
2248	IDMan.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2804	1256	cmd.exe	29
PID 1256 wrote to memory of 2804	1256	cmd.exe	29
PID 1256 wrote to memory of 2804	1256	cmd.exe	29
PID 1256 wrote to memory of 1136	1256	cmd.exe	30
PID 1256 wrote to memory of 1136	1256	cmd.exe	30
PID 1256 wrote to memory of 1136	1256	cmd.exe	30
PID 1256 wrote to memory of 2564	1256	cmd.exe	32
PID 1256 wrote to memory of 2564	1256	cmd.exe	32
PID 1256 wrote to memory of 2564	1256	cmd.exe	32
PID 1256 wrote to memory of 2992	1256	cmd.exe	33
PID 1256 wrote to memory of 2992	1256	cmd.exe	33
PID 1256 wrote to memory of 2992	1256	cmd.exe	33
PID 1256 wrote to memory of 2716	1256	cmd.exe	34
PID 1256 wrote to memory of 2716	1256	cmd.exe	34
PID 1256 wrote to memory of 2716	1256	cmd.exe	34
PID 2716 wrote to memory of 2608	2716	cmd.exe	35
PID 2716 wrote to memory of 2608	2716	cmd.exe	35
PID 2716 wrote to memory of 2608	2716	cmd.exe	35
PID 1256 wrote to memory of 2808	1256	cmd.exe	36
PID 1256 wrote to memory of 2808	1256	cmd.exe	36
PID 1256 wrote to memory of 2808	1256	cmd.exe	36
PID 1256 wrote to memory of 2772	1256	cmd.exe	37
PID 1256 wrote to memory of 2772	1256	cmd.exe	37
PID 1256 wrote to memory of 2772	1256	cmd.exe	37
PID 1256 wrote to memory of 2928	1256	cmd.exe	38
PID 1256 wrote to memory of 2928	1256	cmd.exe	38
PID 1256 wrote to memory of 2928	1256	cmd.exe	38
PID 1256 wrote to memory of 2588	1256	cmd.exe	39
PID 1256 wrote to memory of 2588	1256	cmd.exe	39
PID 1256 wrote to memory of 2588	1256	cmd.exe	39
PID 1256 wrote to memory of 2468	1256	cmd.exe	40
PID 1256 wrote to memory of 2468	1256	cmd.exe	40
PID 1256 wrote to memory of 2468	1256	cmd.exe	40
PID 1256 wrote to memory of 2636	1256	cmd.exe	41
PID 1256 wrote to memory of 2636	1256	cmd.exe	41
PID 1256 wrote to memory of 2636	1256	cmd.exe	41
PID 1256 wrote to memory of 2480	1256	cmd.exe	42
PID 1256 wrote to memory of 2480	1256	cmd.exe	42
PID 1256 wrote to memory of 2480	1256	cmd.exe	42
PID 1256 wrote to memory of 2420	1256	cmd.exe	43
PID 1256 wrote to memory of 2420	1256	cmd.exe	43
PID 1256 wrote to memory of 2420	1256	cmd.exe	43
PID 1256 wrote to memory of 2416	1256	cmd.exe	44
PID 1256 wrote to memory of 2416	1256	cmd.exe	44
PID 1256 wrote to memory of 2416	1256	cmd.exe	44
PID 1256 wrote to memory of 2436	1256	cmd.exe	45
PID 1256 wrote to memory of 2436	1256	cmd.exe	45
PID 1256 wrote to memory of 2436	1256	cmd.exe	45
PID 1256 wrote to memory of 2452	1256	cmd.exe	46
PID 1256 wrote to memory of 2452	1256	cmd.exe	46
PID 1256 wrote to memory of 2452	1256	cmd.exe	46
PID 1256 wrote to memory of 2488	1256	cmd.exe	47
PID 1256 wrote to memory of 2488	1256	cmd.exe	47
PID 1256 wrote to memory of 2488	1256	cmd.exe	47
PID 1256 wrote to memory of 2496	1256	cmd.exe	48
PID 1256 wrote to memory of 2496	1256	cmd.exe	48
PID 1256 wrote to memory of 2496	1256	cmd.exe	48
PID 1256 wrote to memory of 2544	1256	cmd.exe	49
PID 1256 wrote to memory of 2544	1256	cmd.exe	49
PID 1256 wrote to memory of 2544	1256	cmd.exe	49
PID 1256 wrote to memory of 2900	1256	cmd.exe	50
PID 1256 wrote to memory of 2900	1256	cmd.exe	50
PID 1256 wrote to memory of 2900	1256	cmd.exe	50
PID 1256 wrote to memory of 2940	1256	cmd.exe	51

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDM\!)̻.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\reg.exe
  REG QUERY "HKU\S-1-5-19"
  2⤵
  PID:2804
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "IDM*" /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "IEMonitor.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "MediumILStart.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic userAccount where "Name='Admin'" get SID /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic userAccount where "Name='Admin'" get SID /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\Windows\system32\reg.exe
  reg delete "HKU\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:2808
- C:\Windows\system32\reg.exe
  reg delete "HKU\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:2772
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  2⤵
  PID:2588
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  2⤵
  PID:2480
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  2⤵
  PID:2420
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  2⤵
  PID:2452
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  2⤵
  PID:2544
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  2⤵
  PID:2900
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  2⤵
  PID:2472
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:1276
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  2⤵
  PID:2652
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  2⤵
  PID:576
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  2⤵
  PID:588
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  2⤵
  PID:268
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  2⤵
  PID:464
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  2⤵
  PID:2764
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  2⤵
  PID:2712
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  2⤵
  PID:2696
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  2⤵
  PID:2800
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  2⤵
  PID:2784
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  2⤵
  PID:740
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  2⤵
  PID:436
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  2⤵
  PID:580
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f
  2⤵
  PID:1636
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f
  2⤵
  PID:2388
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  2⤵
  PID:1212
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  2⤵
  PID:1944
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  2⤵
  PID:1964
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  2⤵
  PID:1484
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  2⤵
  PID:760
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  2⤵
  PID:284
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  2⤵
  PID:1520
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
  2⤵
  PID:2356
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  2⤵
  PID:1068
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
  2⤵
  PID:796
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  2⤵
  PID:2168
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  2⤵
  PID:788
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
  2⤵
  PID:1100
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
  2⤵
  PID:928
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  2⤵
  PID:1112
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  2⤵
  PID:1716
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  2⤵
  PID:2152
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:364
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  2⤵
  PID:2700
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  2⤵
  PID:1096
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  2⤵
  PID:1676
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  2⤵
  PID:108
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  2⤵
  PID:112
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  2⤵
  PID:1660
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  2⤵
  PID:2280
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  2⤵
  PID:2296
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  2⤵
  PID:2264
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\DownloadManager" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Download Manager" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Internet Download Manager" /f
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\DownloadManager" /f
  2⤵
  PID:836
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\Download Manager" /f
  2⤵
  PID:2316
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "LName" /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "FName" /f
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "Email" /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "Serial" /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "scansk" /f
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "MData" /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "tvfrdt" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\DownloadManager" /v "CheckUpdtVM" /f
  2⤵
  PID:3016
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\DownloadManager" /f
  2⤵
  PID:3024
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Download Manager" /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Wow6432Node\DownloadManager" /f
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg delete "HKU\.DEFAULT\Software\Wow6432Node\Download Manager" /f
  2⤵
  PID:1864
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
  2⤵
  PID:1816
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
  2⤵
  PID:996
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\Wow6432Node\CurrentVersion\Run" /f /v "IDMan"
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "LName" /d "All Users"
  2⤵
  PID:1868
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "LName" /d "[email protected]"
  2⤵
  PID:2132
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "Serial" /d "88888-88888-88888-88888"
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\WOW6432Node\Internet Download Manager" /f /v "LName" /d "All Users"
  2⤵
  PID:984
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\WOW6432Node\Internet Download Manager" /f /v "Email" /d "[email protected]"
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\WOW6432Node\Internet Download Manager" /f /v "Serial" /d "88888-88888-88888-88888"
  2⤵
  PID:2860
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "LanguageID" /t REG_DWORD /d "2052"
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "ToolbarStyle" /d "Faenza"
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "TipStartUp" /t REG_DWORD /d "1"
  2⤵
  PID:2956
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\DownloadManager" /f /v "LaunchOnStart" /t REG_DWORD /d "0"
  2⤵
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe
  idmBroker.exe -RegServer
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\IDM\IDMan.exe
  IDMan.exe /onsilentsetup /s /q
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2248
- - C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe" -instdriv
    3⤵
    PID:1808
  - - C:\Windows\system32\RUNDLL32.EXE
      "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\IDM\idmwfp.inf
      4⤵
      Drops file in Drivers directory
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:2932
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:2188
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:2948
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" start IDMWFP
      4⤵
      PID:2508
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start IDMWFP
        5⤵
        
        PID:1252
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" start IDMWFP
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start IDMWFP
        5⤵
        
        PID:2552
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" start IDMWFP
      4⤵
      PID:2564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start IDMWFP
        5⤵
        
        PID:2672
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" start IDMWFP
      4⤵
      PID:2664
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start IDMWFP
        5⤵
        
        PID:2716
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" start IDMWFP
      4⤵
      PID:2772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start IDMWFP
        5⤵
        
        PID:2468
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" start IDMWFP
      4⤵
      PID:2424
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start IDMWFP
        5⤵
        
        PID:2464
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
      4⤵
      PID:2488
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
        5⤵
        Registers COM server for autorun
        
        PID:2920
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
    3⤵
    PID:2904
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
      4⤵
      Registers COM server for autorun
      PID:2352
- - C:\Users\Admin\AppData\Local\Temp\IDM\IDMIntegrator64.exe
    "C:\Users\Admin\AppData\Local\Temp\IDM\IDMIntegrator64.exe" -runcm
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1560
- C:\Windows\system32\mshta.exe
  mshta VBScript:Execute("Set a=CreateObject(""WScript.Shell""):Set b=a.CreateShortcut(a.SpecialFolders(""Desktop"") & ""\Internet Download Manager.lnk""):b.TargetPath=""C:\Users\Admin\AppData\Local\Temp\IDM\IDMan.exe"":b.WorkingDirectory=""C:\Users\Admin\AppData\Local\Temp\IDM\"":b.Save:close")
  2⤵
  - Modifies Internet Explorer settings
  PID:1588
- C:\Windows\system32\timeout.exe
  TIMEOUT /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\IDM\SCHEDU~1\s_1.dt

Filesize
316B

MD5
2639455c21b61de370e5e4e500a9c008

SHA1
b68a4bc7c4b521a2544459e603fbe706027f4e4e

SHA256
6d059e9c4670699aaa1b1594917d1be5fe752517d7c7e505f227e8dd181dcebb

SHA512
e7cf7fe5eebec79f70ed6b2fae0fdfe2c992fc240b0e6bc4a73e00aad01fdb1e13fd69a55b8b2a3b7a2c314c1ccbfc18284293f06ff5e875f0b64a86054db404

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmfc.dat

Filesize
3KB

MD5
68bad5803dea384643de8f165ebef92d

SHA1
373f2fe37fe8043d17ad7a674e6210493dd12c0c

SHA256
81d963890113d63fc5b3fab5c8135295b4477cd1ceb4888fbaa31fa59f217170

SHA512
e801280bdcf6c5b5dd9611572473eed962ba726fa5737adb3b984b2bac216582a79370327ea889ccd615d9443f713d84c5407be4badca6e10c77850741c07d61

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\CHROME~1.MAN

Filesize
1KB

MD5
bbc14a39b1036a5a55720fb033f5d678

SHA1
e291b498ac75c34b15d0b9ac976ad84561d7d13d

SHA256
9f049ccb3aa99c45b04b45fc4b6d25b9acb22210b5e953ee35cbcb1d15084b70

SHA512
c5861de0225f53a4045570586b7849d55ba3b0732da2c9c59e2b6c33a38ecd47323fe14022e5ddbd7bde7e500a3f71144957d143d3e243d5edcef65a351f6df8

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\IDMHEL~1.JS

Filesize
17KB

MD5
2a20155907354d73043a2070b009dc88

SHA1
cdc3332ed63056792122a91760d79f87376a9b95

SHA256
038b464b3e07f0810d78d6cfacb2ad7046da4eb691fc357907c4b02c76dde5e9

SHA512
0efd0df6fbc0d57fcb3196f7a3bf63e79ee29c91edb47f2f6db072a8a10bcd4420b92b9d51fd809e5ff99b425a0cd3970f145397850ac3f6d615760af762978b

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\IIDMHE~1.XPT

Filesize
2KB

MD5
2add675cc49ce3e2fc56521a9fc649dd

SHA1
085d971e95c75e81e46f876ab88c0fe7b832f67b

SHA256
5bb993f4a7b7aaff7814f25fa3e935d99e7446be1304dd8c2873643f2b97667e

SHA512
fecda2c9f5dfc7fdf5b5d2033a5b4448d0844152e150b30871a75625f9f729136e645f1ea6112e2295741a8851f559f187531093a12da9965e8bdf4c36a7d511

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\idmmzcc.dll

Filesize
33KB

MD5
f4cb6977facfd7c51c5ae061b1d4289d

SHA1
6ef84d39ccf82313f2c061862b61e2f409f09314

SHA256
92b753d1e48230b3fc5d1ab3afd4353273d08f1a4bdea520df0087318a6c0ff7

SHA512
5be7b577d43bc7782356d99816bec9869c0a358e3ef52da3b3ce500e82c6406c76c62a32e225450d7d04ca6ae072418639632f3fe2d201c4ef62e31237dddac9

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~2\IDMMZC~1.DLL

Filesize
31KB

MD5
11dad11f8cc43abb1eb8a83e6c0ed317

SHA1
8fa273c2b0f7290c59efc14613951b48a25d6b5f

SHA256
721aa5f82a1bab41544b8317e2a80e94e41dfc882f4a6ef1c42500c8c496f5ae

SHA512
673ece7db412daeda295c6eda3714ed556fced0465ced5dfe221a31bf1a66c4ac9daa79e4290d528a152e5d8b5940a39e7977c7b53eede12693207deb4e79ebd

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~2\idmmzcc.dll

Filesize
26KB

MD5
084ecdf58f4f694777d38a588a54b56a

SHA1
2b06616643cd096f7467e387b9df2b748d91885c

SHA256
4b924f07115ab9a2f2d7a83a878a692f7880d62cfad6145c86bd53548d10821f

SHA512
575b609c20e541e4f37e5d61d3dcbfd894c0a4af9ac678a80545e4a9947d3cbf745033663c5a32267407a67aa50219adc586b690e3de3c2bc39d4c4862349402

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMCCH~1.DLL

Filesize
326KB

MD5
36b618f848d6dda620bf0b151eacf02d

SHA1
fce4b8bacd1b764c01051603e6548f8b458ee2b8

SHA256
1450146b904919474ef6d528b20a672a33a32afc4a1e40f69d515b523d72fa19

SHA512
b5cbadaa41ac4cfd634c6a7546a4d25116ea33b88f9d5136f2b8982299f3dc50b18b01b0afde4efa4a0fa28b48d539a4039196d9a983c43b4b4cd8395ec4d31b

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMCCH~2.DLL

Filesize
451KB

MD5
5012ea14f13dd58ffeb14553824d8ebb

SHA1
416009ed1d66d9e19e6a5d0e45f90923892c94e1

SHA256
59ac02f5a0644bf56b7ad7e2b48fc8f89083f8cfe12a0a93f63163a5573a876f

SHA512
d86880353c24cff8580b799afcbe3e5319a2d454bb72fdad37f950d4470b51b3adf46e685bcae49111de6864543d5a51a6849e804cd32e292cabdb6d9c443617

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMHEL~1.JS

Filesize
1KB

MD5
9a835016af8ab4355ee1233e7561a86e

SHA1
15d2b0f0c45649a14e537903f45766411edda2a3

SHA256
c435a45c3a3e1d7c208dda4cd47377416772fcaa274aa2e48bc1322a7c1fdc6b

SHA512
d621f865b1d5ecd0cc3fb293cb590da7931ecb9d008ede891b183aebc2a232d97a50c9ac72c25c76de10eee3706afb06c6eef7ddd489e77bad0982e2f6f139cf

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMMZC~1.DLL

Filesize
27KB

MD5
8b640fb5a8a1a7358ae8beaa7c208d9a

SHA1
685ffdfeb8fb5d0e43ab0124554015bc261ce1ba

SHA256
132591d6563f9bb425edf9604ed1886809c7856bc203d3af71c1af932befc70e

SHA512
db37ff023b21fc58f860adabc14ad030d584f45cfb6d9c284bcaa123c417c12cd7c0c26e199541b28464ba8a80f00d3bfa22837a7dcbbdde576f111867e19833

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IIDMHE~1.XPT

Filesize
331B

MD5
1429ed34a62d6111144e44b8dabf165d

SHA1
c5a88c1969047c65856486ccb489810925073e1d

SHA256
0e2315ea37b8c7116254a4c53294eec13ebd2596d8205a8999051728e026cc0d

SHA512
f4585a6b2508d04e23697655916086cf3506d5c2e79506334f1105bce1d39e7406eae3f09ed1ad4522e2d470e4239f25dbbb2c77261927e6341058cbfb0dc3df

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\iIDMMzCC.xpt

Filesize
569B

MD5
03578f7e2125cd5075c04c373012360b

SHA1
09126b32f41f6951af85f380f49b59eccdd4fbb2

SHA256
4fdd09827e9a971c5fed06cad46cec79365f522e6cc280c58982051907538f4e

SHA512
c683125a43bee164f2748b0673489be132eaa6147f6b2a71b7bedc99e251e687d731b978519c5aa873ca90873318884b4dcb7c0b99446d20db15a03d5052962d

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\idmmzcc.dll

Filesize
33KB

MD5
8fae57c6c9a27c01e9d4591f4e2cd6b2

SHA1
567d21d96d20f350619eb13579f9b556d2419251

SHA256
c9b83ce41312ea7ad7d00a57fc4933c0ef02d5df95bc2326be52b52ae1e15ad0

SHA512
9cd394f0c0583dc631e5d613929bb42a01fde299ff4a9edeb635a886550c31dfefeb4899bf7fe3cdce71d4746185a7a02da0b7c80c36d1e822465f653c264712

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\META-INF\manifest.mf

Filesize
2KB

MD5
6385dfa9936c206b146e390b9c776a87

SHA1
e80669a3d711138b5a1fe8edb5bd04300afb30f8

SHA256
8f33411f05f344dbb2b278ae9e6f7c2c41ab154620ef5b65d2392c3c1740f83f

SHA512
09088fd4cec9cbc8c9f9167707465ded4bfa2434d4963064e80ea39a061c863e2449fcf2ceaa412de4c03dec845c570ff8d8d3bd73f6e5e8bcc8987bc80d8d68

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\META-INF\zigbert.rsa

Filesize
4KB

MD5
0c24a5190f932c3fc2b12b879c230bfa

SHA1
fd4d35df7b997ac545c6786667610c5ee9bd55c5

SHA256
1d096ea115ec7cbf3cd66fa2911c8e655e939d9c00a5abb6625504f14cc7c85a

SHA512
7c2827546ead153febaadd4428dd9c54435e3f7013cb9c605370a7c813320369379380e3232134bef5a074ecf2d08f3ab1a7d32ccc528e6205c3efc6440a5c03

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\META-INF\zigbert.sf

Filesize
2KB

MD5
194c81e95e15bee24ef8818e9f1da141

SHA1
a1ef6ddc40bf88cc99128cdefddb40d562c48bbf

SHA256
eefd986b8fe74645cec660746c189cffadbc9269d804809fbd09615a662c0ab7

SHA512
ffa098a8afb5b1a7e3550ed4569395032f20f4382654f1bf0cd487bb349af8b8df9f22dca76530ebf93b4c145021e1c285d75bba1111d03a2e3437e485bd1ba6

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\chrome\idmmzcc.jar

Filesize
5KB

MD5
191be8f3b55fe69e2dac9fe6810252f5

SHA1
fd8a6e8b439eceb934cc5ebf75185e6473f4db6b

SHA256
562269a4b8887831450ee7deb0d3f30a1424f73499b2ae062e63c6841063efa9

SHA512
515b712377796c0b699a8770c392b9cb82d14f36078d0c63eaf32c5641b3d1d901bd58c91681dead2cce3ef10c4710a5a08793f809cc24b9a13dec6e0e538e98

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\icon.png

Filesize
4KB

MD5
a647e3e381c7e5f60cb1d81075884177

SHA1
ba1b6d20c18b87894bbeab8e06b22bb4798d5eb8

SHA256
24026ee7bd835c331ef466b1b2083116fa67d996805de53f7b1e92af9b57f81b

SHA512
b5cf6ae6d6d344871177287cef639bba8129ab59cb04a362792548e5e8f0514cbd5d1cfb8e11f65a047dee6484c4ec8de3c9f2f28fd6c5d49768a352137b539f

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\install.js

Filesize
700B

MD5
3af40e8c059c4b706df4af244373fd82

SHA1
d32b291922fd8d5004574558650a3d38af5fe3ff

SHA256
20dd9541048e3c2bc5ca26b491cd273df9af2e3b3f30d8c8bcf17ea17cb5454b

SHA512
2fcdaa6064864c98d051f0563e07ae73777f88bd0225e87251d262a9a502cb56becdd36286ef9d37c630da845fc1393f05c6fcd065b8271222ef977f4127f02d

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\install.rdf

Filesize
2KB

MD5
f87821598fe5b270d1dab741733c5703

SHA1
ec34c93b8cb1679b1d9c9277c0f8233bd9223ed7

SHA256
a4e709069b95e4fa4bc17d65a028e91a7f1ea3ef9ca0ed22ce4b704f3307ba52

SHA512
06654c98c0ba9fee92de469f833d3fa989cb1deba92c319e3c8057d839fb4b6250e61f5e1d8b5c4a22c24926bec9209bfd64651ee6335ff2f05271f98e75e1f6

Download Submit
memory/1808-32-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/1808-38-0x0000000000330000-0x000000000033D000-memory.dmp

Filesize
52KB

Download
memory/1808-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2248-27-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/2248-31-0x00000000028B0000-0x00000000028D9000-memory.dmp

Filesize
164KB

Download
memory/2248-30-0x00000000028B0000-0x00000000028D9000-memory.dmp

Filesize
164KB

Download
memory/2248-29-0x00000000028B0000-0x00000000028D9000-memory.dmp

Filesize
164KB

Download
memory/2248-28-0x0000000000410000-0x0000000000439000-memory.dmp

Filesize
164KB

Download
memory/2248-41-0x00000000028B0000-0x00000000028B6000-memory.dmp

Filesize
24KB

Download