Overview
overview
8Static
static
3IDM/!)卸载.bat
windows7-x64
8IDM/!)卸载.bat
windows10-2004-x64
8IDM/!)绿化.bat
windows7-x64
8IDM/!)绿化.bat
windows10-2004-x64
8IDM/423Down.url
windows7-x64
6IDM/423Down.url
windows10-2004-x64
3background.js
windows7-x64
3background.js
windows10-2004-x64
3captured.html
windows7-x64
3captured.html
windows10-2004-x64
3captured.js
windows7-x64
3captured.js
windows10-2004-x64
3content.js
windows7-x64
3content.js
windows10-2004-x64
3debug.js
windows7-x64
3debug.js
windows10-2004-x64
3document.js
windows7-x64
3document.js
windows10-2004-x64
3welcome.html
windows7-x64
3welcome.html
windows10-2004-x64
3welcome.js
windows7-x64
3welcome.js
windows10-2004-x64
3IDM/IDMFType64.dll
windows7-x64
1IDM/IDMFType64.dll
windows10-2004-x64
1background.js
windows7-x64
3background.js
windows10-2004-x64
3captured.html
windows7-x64
3captured.html
windows10-2004-x64
3captured.js
windows7-x64
3captured.js
windows10-2004-x64
3content.js
windows7-x64
3content.js
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
IDM/!)卸载.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
IDM/!)卸载.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
IDM/!)绿化.bat
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
IDM/!)绿化.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
IDM/423Down.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
IDM/423Down.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
background.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
background.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captured.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captured.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captured.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
captured.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
content.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
content.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
debug.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
debug.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
document.js
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
document.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
welcome.html
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
welcome.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
welcome.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
welcome.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
IDM/IDMFType64.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
IDM/IDMFType64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
background.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
background.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captured.html
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
captured.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captured.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
captured.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
content.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
content.js
Resource
win10v2004-20240802-en
General
-
Target
IDM/!)卸载.bat
-
Size
14KB
-
MD5
3decac4cda3e2c761b6c25a7c6afc8d6
-
SHA1
857bac5e36b567021c39c90b0590aef558ae3f24
-
SHA256
a058383a79b829bceeac7f183968adba2a38824c41f6d0bd3741ad9d753cf4d0
-
SHA512
258efc5a8eca2d28a257783753a5c7242c8c5ea85e7d9c88515610d2e7c50eaa89164dc6fa3109fa3829604a67f88fa7ae2d63c11dbea0aca41cd19da6b4727a
-
SSDEEP
384:4CFmoOfgEpLkHr5kkBQUsnLow8jS32AIF+uVF+uS:9r5kkBQxLow8jo2AL
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\idmwfp.sys RUNDLL32.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idmBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
Kills process with taskkill 3 IoCs
pid Process 3112 taskkill.exe 4164 taskkill.exe 4736 taskkill.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B} reg.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights idmBroker.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy idmBroker.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B} idmBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppName = "idmBroker.exe" idmBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM" idmBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\Policy = "3" idmBroker.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ProxyStubClsid32 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8} idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\HELPDIR reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib\ = "{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}" idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\0\win32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\0 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\ProgID\ = "idmBroker.OptionsReader.1" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\idmBroker.exe" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\ProgID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader\ = "OptionsReader Class" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\VersionIndependentProgID\ = "idmBroker.OptionsReader" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\ = "OptionsReader Class" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM\\idmBroker.exe\"" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\TypeLib\ = "{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\FLAGS\ = "0" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader\CLSID\ = "{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA} idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ = "IOptionsReader" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib\Version = "1.0" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1\CLSID\ = "{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\TypeLib idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\Programmable reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B} idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ProxyStubClsid32 idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\HELPDIR idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B} idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\idmBroker.EXE\AppID = "{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8}" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\0\win32 idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1\ = "OptionsReader Class" idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\idmBroker.EXE reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ProxyStubClsid32 idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\LocalServer32 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\ = "idmBroker 1.0 Type Library" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ = "IOptionsReader" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1\CLSID idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader\CLSID idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader\CurVer idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E} idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2223E76A-0894-4502-841F-0CF7517A713B} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8}\ = "idmBroker" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\idmBroker.EXE idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader\CurVer reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\0 idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM" idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\Programmable idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\FLAGS idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" idmBroker.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}\1.0\FLAGS reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\idmBroker.OptionsReader.1 idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}\VersionIndependentProgID idmBroker.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2160 regedit.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 3112 taskkill.exe Token: SeDebugPrivilege 4164 taskkill.exe Token: SeDebugPrivilege 4736 taskkill.exe Token: SeIncreaseQuotaPrivilege 1124 WMIC.exe Token: SeSecurityPrivilege 1124 WMIC.exe Token: SeTakeOwnershipPrivilege 1124 WMIC.exe Token: SeLoadDriverPrivilege 1124 WMIC.exe Token: SeSystemProfilePrivilege 1124 WMIC.exe Token: SeSystemtimePrivilege 1124 WMIC.exe Token: SeProfSingleProcessPrivilege 1124 WMIC.exe Token: SeIncBasePriorityPrivilege 1124 WMIC.exe Token: SeCreatePagefilePrivilege 1124 WMIC.exe Token: SeBackupPrivilege 1124 WMIC.exe Token: SeRestorePrivilege 1124 WMIC.exe Token: SeShutdownPrivilege 1124 WMIC.exe Token: SeDebugPrivilege 1124 WMIC.exe Token: SeSystemEnvironmentPrivilege 1124 WMIC.exe Token: SeRemoteShutdownPrivilege 1124 WMIC.exe Token: SeUndockPrivilege 1124 WMIC.exe Token: SeManageVolumePrivilege 1124 WMIC.exe Token: 33 1124 WMIC.exe Token: 34 1124 WMIC.exe Token: 35 1124 WMIC.exe Token: 36 1124 WMIC.exe Token: SeIncreaseQuotaPrivilege 1124 WMIC.exe Token: SeSecurityPrivilege 1124 WMIC.exe Token: SeTakeOwnershipPrivilege 1124 WMIC.exe Token: SeLoadDriverPrivilege 1124 WMIC.exe Token: SeSystemProfilePrivilege 1124 WMIC.exe Token: SeSystemtimePrivilege 1124 WMIC.exe Token: SeProfSingleProcessPrivilege 1124 WMIC.exe Token: SeIncBasePriorityPrivilege 1124 WMIC.exe Token: SeCreatePagefilePrivilege 1124 WMIC.exe Token: SeBackupPrivilege 1124 WMIC.exe Token: SeRestorePrivilege 1124 WMIC.exe Token: SeShutdownPrivilege 1124 WMIC.exe Token: SeDebugPrivilege 1124 WMIC.exe Token: SeSystemEnvironmentPrivilege 1124 WMIC.exe Token: SeRemoteShutdownPrivilege 1124 WMIC.exe Token: SeUndockPrivilege 1124 WMIC.exe Token: SeManageVolumePrivilege 1124 WMIC.exe Token: 33 1124 WMIC.exe Token: 34 1124 WMIC.exe Token: 35 1124 WMIC.exe Token: 36 1124 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2948 2520 cmd.exe 83 PID 2520 wrote to memory of 2948 2520 cmd.exe 83 PID 2520 wrote to memory of 3112 2520 cmd.exe 84 PID 2520 wrote to memory of 3112 2520 cmd.exe 84 PID 2520 wrote to memory of 4164 2520 cmd.exe 86 PID 2520 wrote to memory of 4164 2520 cmd.exe 86 PID 2520 wrote to memory of 4736 2520 cmd.exe 87 PID 2520 wrote to memory of 4736 2520 cmd.exe 87 PID 2520 wrote to memory of 3560 2520 cmd.exe 88 PID 2520 wrote to memory of 3560 2520 cmd.exe 88 PID 2520 wrote to memory of 3560 2520 cmd.exe 88 PID 2520 wrote to memory of 1380 2520 cmd.exe 89 PID 2520 wrote to memory of 1380 2520 cmd.exe 89 PID 2520 wrote to memory of 1380 2520 cmd.exe 89 PID 1380 wrote to memory of 3528 1380 Uninstall.exe 90 PID 1380 wrote to memory of 3528 1380 Uninstall.exe 90 PID 3528 wrote to memory of 2484 3528 RUNDLL32.EXE 92 PID 3528 wrote to memory of 2484 3528 RUNDLL32.EXE 92 PID 2484 wrote to memory of 4328 2484 runonce.exe 93 PID 2484 wrote to memory of 4328 2484 runonce.exe 93 PID 2520 wrote to memory of 2884 2520 cmd.exe 95 PID 2520 wrote to memory of 2884 2520 cmd.exe 95 PID 2884 wrote to memory of 1808 2884 regsvr32.exe 96 PID 2884 wrote to memory of 1808 2884 regsvr32.exe 96 PID 2884 wrote to memory of 1808 2884 regsvr32.exe 96 PID 2520 wrote to memory of 2832 2520 cmd.exe 97 PID 2520 wrote to memory of 2832 2520 cmd.exe 97 PID 2520 wrote to memory of 3268 2520 cmd.exe 98 PID 2520 wrote to memory of 3268 2520 cmd.exe 98 PID 3268 wrote to memory of 1124 3268 regsvr32.exe 196 PID 3268 wrote to memory of 1124 3268 regsvr32.exe 196 PID 3268 wrote to memory of 1124 3268 regsvr32.exe 196 PID 2520 wrote to memory of 2004 2520 cmd.exe 200 PID 2520 wrote to memory of 2004 2520 cmd.exe 200 PID 2520 wrote to memory of 3220 2520 cmd.exe 203 PID 2520 wrote to memory of 3220 2520 cmd.exe 203 PID 3220 wrote to memory of 520 3220 regsvr32.exe 102 PID 3220 wrote to memory of 520 3220 regsvr32.exe 102 PID 3220 wrote to memory of 520 3220 regsvr32.exe 102 PID 2520 wrote to memory of 4192 2520 cmd.exe 103 PID 2520 wrote to memory of 4192 2520 cmd.exe 103 PID 2520 wrote to memory of 3164 2520 cmd.exe 104 PID 2520 wrote to memory of 3164 2520 cmd.exe 104 PID 3164 wrote to memory of 1592 3164 regsvr32.exe 105 PID 3164 wrote to memory of 1592 3164 regsvr32.exe 105 PID 3164 wrote to memory of 1592 3164 regsvr32.exe 105 PID 2520 wrote to memory of 1424 2520 cmd.exe 211 PID 2520 wrote to memory of 1424 2520 cmd.exe 211 PID 2520 wrote to memory of 3592 2520 cmd.exe 107 PID 2520 wrote to memory of 3592 2520 cmd.exe 107 PID 2520 wrote to memory of 3104 2520 cmd.exe 215 PID 2520 wrote to memory of 3104 2520 cmd.exe 215 PID 2520 wrote to memory of 3224 2520 cmd.exe 214 PID 2520 wrote to memory of 3224 2520 cmd.exe 214 PID 2520 wrote to memory of 4284 2520 cmd.exe 110 PID 2520 wrote to memory of 4284 2520 cmd.exe 110 PID 2520 wrote to memory of 3660 2520 cmd.exe 111 PID 2520 wrote to memory of 3660 2520 cmd.exe 111 PID 2520 wrote to memory of 2208 2520 cmd.exe 112 PID 2520 wrote to memory of 2208 2520 cmd.exe 112 PID 2520 wrote to memory of 2180 2520 cmd.exe 218 PID 2520 wrote to memory of 2180 2520 cmd.exe 218 PID 2520 wrote to memory of 1416 2520 cmd.exe 114 PID 2520 wrote to memory of 1416 2520 cmd.exe 114
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IDM\!)卸载.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\reg.exeREG QUERY "HKU\S-1-5-19"2⤵PID:2948
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "IDM*" /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "IEMonitor.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "MediumILStart.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe"C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe" -RegServer2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:3560
-
-
C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe" -uninstdriv2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\Users\Admin\AppData\Local\Temp\IDM\idmwfp.inf3⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵PID:4328
-
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u IDMIECC.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\regsvr32.exe/s /u IDMIECC.dll3⤵
- System Location Discovery: System Language Discovery
PID:1808
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u IDMIECC64.dll2⤵PID:2832
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u IDMGetAll.dll2⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\regsvr32.exe/s /u IDMGetAll.dll3⤵
- System Location Discovery: System Language Discovery
PID:1124
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u IDMGetAll64.dll2⤵PID:2004
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u IDMShellExt.dll2⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\regsvr32.exe/s /u IDMShellExt.dll3⤵
- System Location Discovery: System Language Discovery
PID:520
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u IDMShellExt64.dll2⤵PID:4192
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u downlWithIDM.dll2⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\regsvr32.exe/s /u downlWithIDM.dll3⤵
- System Location Discovery: System Language Discovery
PID:1592
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u downlWithIDM64.dll2⤵PID:1424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"2⤵PID:3592
-
-
C:\Windows\system32\findstr.exefindstr "\<6\.[0-9]\.[0-9][0-9]*\> \<10\.[0-9]\.[0-9][0-9]*\>"2⤵PID:3104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"2⤵PID:3224
-
-
C:\Windows\system32\findstr.exefindstr "5\.[0-9]\.[0-9][0-9]*"2⤵PID:4284
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Download Manager" /f2⤵PID:3660
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Download Manager" /f /reg:322⤵PID:2208
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\DownloadManager" /f2⤵PID:2180
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Download Manager" /f2⤵PID:1416
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\DownloadManager" /f /reg:322⤵PID:3020
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Download Manager" /f /reg:322⤵PID:764
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Internet Download Manager" /f2⤵PID:5024
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Internet Download Manager" /f /reg:322⤵PID:4524
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"2⤵PID:2572
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan" /reg:322⤵PID:4436
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter" /f2⤵PID:1488
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Idmfsa.IDMEFSAgent" /f2⤵PID:4764
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Idmfsa.IDMEFSAgent.1" /f2⤵PID:1684
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\AppID\idmBroker.EXE" /f2⤵
- Modifies registry class
PID:2448
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\idmBroker.OptionsReader" /f2⤵
- Modifies registry class
PID:5060
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\idmBroker.OptionsReader.1" /f2⤵
- Modifies registry class
PID:1564
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\AppID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f2⤵PID:3096
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8}" /f2⤵
- Modifies registry class
PID:2492
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f2⤵PID:3824
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f2⤵PID:4488
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f2⤵PID:1044
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f2⤵PID:1672
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f2⤵PID:3908
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}" /f2⤵PID:4992
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}" /f2⤵PID:1480
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}" /f2⤵
- Modifies registry class
PID:832
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}" /f2⤵
- Modifies registry class
PID:5028
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}" /f2⤵PID:4888
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}" /f2⤵PID:2156
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f2⤵PID:4084
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}" /f2⤵PID:2536
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}" /f2⤵PID:768
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}" /f2⤵PID:5104
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f2⤵PID:2120
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:322⤵PID:1520
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f /reg:322⤵PID:932
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f /reg:322⤵PID:3636
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:322⤵PID:3624
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f /reg:322⤵
- Modifies registry class
PID:1256
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}" /f /reg:322⤵
- Modifies registry class
PID:4588
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}" /f /reg:322⤵PID:3124
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}" /f /reg:322⤵PID:2596
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f /reg:322⤵PID:2412
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}" /f /reg:322⤵PID:3180
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}" /f /reg:322⤵PID:3472
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}" /f /reg:322⤵PID:1952
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:322⤵PID:1032
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:4356
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Google\Chrome\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f2⤵PID:4912
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.tonec.idm" /f /reg:322⤵PID:3728
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Google\Chrome\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f /reg:322⤵PID:2308
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4" /f2⤵PID:2500
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI"2⤵PID:2292
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}" /f2⤵PID:3452
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f2⤵PID:3912
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f2⤵PID:2856
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:322⤵PID:3532
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}" /f /reg:322⤵PID:4736
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f /reg:322⤵PID:4140
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:322⤵PID:3708
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Tracing\IDMan_RASAPI32" /f2⤵PID:1164
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Tracing\IDMan_RASAPI32" /f /reg:322⤵PID:3028
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState" /f /v "PolicyState" /t REG_DWORD /d "2"2⤵PID:2416
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"2⤵PID:4564
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f2⤵PID:3664
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /reg:32 /f2⤵PID:4664
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Classes\CLSID\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f2⤵PID:4956
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\CocCoc\Browser\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:4652
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\CocCoc\Browser\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f2⤵PID:1248
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:4708
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Edge\Extensions\llbjbkhnmlidjebalopleeepgdfgcpec" /f2⤵PID:2140
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI"2⤵PID:1680
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:322⤵PID:5092
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪" /f2⤵PID:3820
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪╚½▓┐┴┤╜╙" /f2⤵PID:3156
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Mozilla\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:1900
-
-
C:\Windows\system32\reg.exePID:3276
-
-
C:\Windows\system32\reg.exePID:3732
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}" /f2⤵PID:2000
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}" /f2⤵
- Modifies Internet Explorer settings
PID:2884
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}" /f2⤵PID:1220
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f2⤵PID:3048
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f2⤵PID:392
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f /reg:322⤵PID:4388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic userAccount where "Name='Admin'" get SID /value2⤵PID:2124
-
C:\Windows\System32\Wbem\WMIC.exewmic userAccount where "Name='Admin'" get SID /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"2⤵PID:2264
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer" /f /v "DownloadUI"2⤵PID:3840
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:322⤵PID:3932
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪" /f2⤵PID:2004
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪╚½▓┐┴┤╜╙" /f2⤵PID:4724
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\CocCoc\Browser\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:3888
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\CocCoc\Browser\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f2⤵PID:3220
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Edge\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:2104
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Edge\Extensions\llbjbkhnmlidjebalopleeepgdfgcpec" /f2⤵PID:116
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Mozilla\NativeMessagingHosts\com.tonec.idm" /f2⤵PID:4800
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"2⤵PID:660
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"2⤵PID:4536
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f2⤵PID:2940
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:322⤵PID:2672
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}" /f2⤵PID:1424
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}" /f2⤵PID:1528
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}" /f2⤵PID:4656
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f2⤵PID:3224
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "MData"2⤵PID:3104
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "Email"2⤵PID:772
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "LName"2⤵PID:3996
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "FName"2⤵PID:2180
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "Serial"2⤵PID:3416
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "tvfrdt"2⤵PID:2872
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "scansk"2⤵PID:3044
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "idmvers"2⤵PID:1204
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "ExePath"2⤵PID:3572
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "TempPath"2⤵PID:2992
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "LstCheck"2⤵PID:744
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "CheckUpdtVM"2⤵PID:3556
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "AppDataIDMFolder"2⤵PID:3600
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\DownloadManager" /f /v "CommonAppDataIDMFolder"2⤵PID:2664
-
-
C:\Windows\regedit.exeregedit /e "!)╤í╧ε┼Σ╓├.reg" HKEY_CURRENT_USER\Software\DownloadManager2⤵
- Runs .reg file with regedit
PID:2160
-
-
C:\Windows\system32\choice.exeCHOICE /C 12 /N2⤵PID:4544
-