Analysis

  • max time kernel
    126s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 12:30

General

  • Target

    IDM/!)绿化.bat

  • Size

    12KB

  • MD5

    1bed77dcf5fa3bc411cb49f9c025ebef

  • SHA1

    ff37c7a653bb3ab47aaaf76569fcc20a3aaa12ab

  • SHA256

    3a8c32da985dc8294ab781865dbe28413c9d34853e4ce0084bdedca644f5e6ff

  • SHA512

    dea77a5a7bfdb9317f482e4da6cad2ade907e0b9931b1941838dae3d791c7077f1ac61b0327634d9fd26c45f1c37044e97c2df01cdc9110cf22f43a0a715cf4d

  • SSDEEP

    192:ev1sv7KbivUXiT5hzW/AHWLx64EXh554/AAQ/AAv/AAa1jc3j:aSF4EuAfuo3j

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\IDM\!)绿化.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\system32\reg.exe
      REG QUERY "HKU\S-1-5-19"
      2⤵
        PID:2492
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IDM*" /T
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1944
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IEMonitor.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2656
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "MediumILStart.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2668
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wmic userAccount where "Name='Admin'" get SID /value
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic userAccount where "Name='Admin'" get SID /value
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2764
      • C:\Windows\system32\reg.exe
        reg delete "HKU\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
        2⤵
          PID:2720
        • C:\Windows\system32\reg.exe
          reg delete "HKU\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:32
          2⤵
            PID:2572
          • C:\Windows\system32\reg.exe
            reg delete "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
            2⤵
              PID:268
            • C:\Windows\system32\reg.exe
              reg delete "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f /reg:32
              2⤵
                PID:2924
              • C:\Windows\system32\reg.exe
                reg delete "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
                2⤵
                  PID:2680
                • C:\Windows\system32\reg.exe
                  reg delete "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f /reg:32
                  2⤵
                    PID:2836
                  • C:\Windows\system32\reg.exe
                    reg delete "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
                    2⤵
                      PID:2600
                    • C:\Windows\system32\reg.exe
                      reg delete "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f /reg:32
                      2⤵
                        PID:2800
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
                        2⤵
                          PID:2812
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f /reg:32
                          2⤵
                            PID:2896
                          • C:\Windows\system32\reg.exe
                            reg delete "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
                            2⤵
                              PID:2880
                            • C:\Windows\system32\reg.exe
                              reg delete "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f /reg:32
                              2⤵
                                PID:2588
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
                                2⤵
                                  PID:1708
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f /reg:32
                                  2⤵
                                    PID:2748
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
                                    2⤵
                                      PID:2728
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f /reg:32
                                      2⤵
                                        PID:2828
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
                                        2⤵
                                          PID:2796
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f /reg:32
                                          2⤵
                                            PID:2620
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                            2⤵
                                              PID:2564
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:32
                                              2⤵
                                                PID:2560
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                                2⤵
                                                  PID:2584
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:32
                                                  2⤵
                                                    PID:2596
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
                                                    2⤵
                                                      PID:2628
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f /reg:32
                                                      2⤵
                                                        PID:2640
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
                                                        2⤵
                                                          PID:2732
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f /reg:32
                                                          2⤵
                                                            PID:3028
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
                                                            2⤵
                                                              PID:2172
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f /reg:32
                                                              2⤵
                                                                PID:2832
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
                                                                2⤵
                                                                  PID:3024
                                                                • C:\Windows\system32\reg.exe
                                                                  reg delete "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f /reg:32
                                                                  2⤵
                                                                    PID:2220
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
                                                                    2⤵
                                                                      PID:3032
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg delete "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f /reg:32
                                                                      2⤵
                                                                        PID:3036
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg delete "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
                                                                        2⤵
                                                                          PID:880
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg delete "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f /reg:32
                                                                          2⤵
                                                                            PID:1980
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg delete "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
                                                                            2⤵
                                                                              PID:2552
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg delete "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f /reg:32
                                                                              2⤵
                                                                                PID:1848
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg delete "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
                                                                                2⤵
                                                                                  PID:3064
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg delete "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f /reg:32
                                                                                  2⤵
                                                                                    PID:2276
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                    2⤵
                                                                                      PID:888
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f /reg:32
                                                                                      2⤵
                                                                                        PID:2408
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg delete "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                        2⤵
                                                                                          PID:2660
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f /reg:32
                                                                                          2⤵
                                                                                            PID:2128
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKCU\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f
                                                                                            2⤵
                                                                                              PID:284
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg delete "HKCU\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f /reg:32
                                                                                              2⤵
                                                                                                PID:840
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg delete "HKLM\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f
                                                                                                2⤵
                                                                                                  PID:1564
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg delete "HKLM\Software\Classes\CLSID\{84797876-C678-1780-A556-0CD06786780F}" /f /reg:32
                                                                                                  2⤵
                                                                                                    PID:2424
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg delete "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
                                                                                                    2⤵
                                                                                                      PID:1260
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg delete "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f /reg:32
                                                                                                      2⤵
                                                                                                        PID:1280
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg delete "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
                                                                                                        2⤵
                                                                                                          PID:1448
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg delete "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f /reg:32
                                                                                                          2⤵
                                                                                                            PID:3008
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
                                                                                                            2⤵
                                                                                                              PID:2804
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg delete "HKLM\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
                                                                                                              2⤵
                                                                                                                PID:2468
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg delete "HKLM\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
                                                                                                                2⤵
                                                                                                                  PID:2252
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg delete "HKLM\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
                                                                                                                  2⤵
                                                                                                                    PID:2104
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg delete "HKLM\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
                                                                                                                    2⤵
                                                                                                                      PID:2464
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg delete "HKLM\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
                                                                                                                      2⤵
                                                                                                                        PID:2476
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg delete "HKLM\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
                                                                                                                        2⤵
                                                                                                                          PID:2028
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg delete "HKLM\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
                                                                                                                          2⤵
                                                                                                                            PID:2056
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg delete "HKLM\SOFTWARE\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
                                                                                                                            2⤵
                                                                                                                              PID:2876
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:32
                                                                                                                              2⤵
                                                                                                                                PID:1140
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f /reg:32
                                                                                                                                2⤵
                                                                                                                                  PID:2000
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg delete "HKLM\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f /reg:32
                                                                                                                                  2⤵
                                                                                                                                    PID:2652
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg delete "HKLM\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f /reg:32
                                                                                                                                    2⤵
                                                                                                                                      PID:2624
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg delete "HKLM\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f /reg:32
                                                                                                                                      2⤵
                                                                                                                                        PID:2860
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:2856
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:32
                                                                                                                                          2⤵
                                                                                                                                            PID:2864
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg delete "HKLM\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f /reg:32
                                                                                                                                            2⤵
                                                                                                                                              PID:2872
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg delete "HKLM\SOFTWARE\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f /reg:32
                                                                                                                                              2⤵
                                                                                                                                                PID:3004
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:1624
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3000
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3056
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2432
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3060
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3068
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2116
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1248
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1116
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f /reg:32
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1872
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f /reg:32
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1864
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f /reg:32
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:996
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f /reg:32
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1868
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:32
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1408
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f /reg:32
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1076
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f /reg:32
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2792
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f /reg:32
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1984
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg delete "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f /reg:32
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1928
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg delete "HKLM" /f /ve
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2548
                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                      reg delete "HKLM" /f /v "MData"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1240
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg delete "HKLM" /f /v "Model"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2348
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg delete "HKLM" /f /v "Therad"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2948
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg delete "HKCU" /f /ve
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2136
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg delete "HKCU" /f /v "MData"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1208
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg delete "HKCU" /f /v "Model"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2268
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg delete "HKCU" /f /v "Therad"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg delete "HKLM\Software\DownloadManager" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg delete "HKLM\Software\Download Manager" /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2152
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg delete "HKLM\SOFTWARE\Internet Download Manager" /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2168
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg delete "HKLM\Software\DownloadManager" /f /reg:32
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg delete "HKLM\Software\Download Manager" /f /reg:32
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:616
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              reg delete "HKLM\SOFTWARE\Internet Download Manager" /f /reg:32
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "MData"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2208
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  reg delete "HKCU\Software\DownloadManager" /f /v "LName"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2448
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg delete "HKCU\Software\DownloadManager" /f /v "FName"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /f /v "Email"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /f /v "Serial"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg delete "HKCU\Software\DownloadManager" /f /v "scansk"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /f /v "tvfrdt"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2892
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /f /v "LstCheck"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:596
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "CheckUpdtVM"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:816
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg delete "HKU\.DEFAULT\Software\DownloadManager" /f
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg delete "HKU\.DEFAULT\Software\Download Manager" /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      reg delete "HKU\.DEFAULT\Software\DownloadManager" /f /reg:32
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1464
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg delete "HKU\.DEFAULT\Software\Download Manager" /f /reg:32
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2428
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan" /reg:32
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                reg add "HKCU\Software\DownloadManager" /f /v "LName" /d "All Users"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1920
                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                  reg add "HKCU\Software\DownloadManager" /f /v "LName" /d "[email protected]"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    reg add "HKCU\Software\DownloadManager" /f /v "Serial" /d "88888-88888-88888-88888"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1028
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      reg add "HKLM\Software\Internet Download Manager" /f /v "LName" /d "All Users" /reg:32
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1288
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg add "HKLM\Software\Internet Download Manager" /f /v "Email" /d "[email protected]" /reg:32
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1504
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg add "HKLM\Software\Internet Download Manager" /f /v "Serial" /d "88888-88888-88888-88888" /reg:32
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1044
                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                            reg add "HKCU\Software\DownloadManager" /f /v "LanguageID" /t REG_DWORD /d "2052"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1724
                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                              reg add "HKCU\Software\DownloadManager" /f /v "ToolbarStyle" /d "Faenza"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                reg add "HKCU\Software\DownloadManager" /f /v "TipStartUp" /t REG_DWORD /d "1"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1988
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  reg add "HKCU\Software\DownloadManager" /f /v "LaunchOnStart" /t REG_DWORD /d "0"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe" -RegServer
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IDM\IDMan.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\IDM\IDMan.exe" /onsilentsetup /s /q
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Installs/modifies Browser Helper Object
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                        /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IDM\IDMIntegrator64.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\IDM\IDMIntegrator64.exe" -runcm
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe" -instdriv
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1924
                                                                                                                                                                                                                                                                        • C:\Windows\system32\RUNDLL32.EXE
                                                                                                                                                                                                                                                                          "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\IDM\idmwfp.inf
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:1768
                                                                                                                                                                                                                                                                          • C:\Windows\system32\runonce.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\runonce.exe" -r
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                            • C:\Windows\System32\grpconv.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\grpconv.exe" -o
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:352
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:276
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2752
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2724
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2904
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2736
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2728
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2620
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2576
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2636
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                            • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                              /s "C:\Users\Admin\AppData\Local\Temp\IDM\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                      • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                        mshta VBScript:Execute("Set a=CreateObject(""WScript.Shell""):Set b=a.CreateShortcut(a.SpecialFolders(""Desktop"") & ""\Internet Download Manager.lnk""):b.TargetPath=""C:\Users\Admin\AppData\Local\Temp\IDM\IDMan.exe"":b.WorkingDirectory=""C:\Users\Admin\AppData\Local\Temp\IDM\"":b.Save:close")
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                        PID:2660
                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                        TIMEOUT /t 2
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:2476

                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\SCHEDU~1\s_1.dt

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      316B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      2639455c21b61de370e5e4e500a9c008

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b68a4bc7c4b521a2544459e603fbe706027f4e4e

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      6d059e9c4670699aaa1b1594917d1be5fe752517d7c7e505f227e8dd181dcebb

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      e7cf7fe5eebec79f70ed6b2fae0fdfe2c992fc240b0e6bc4a73e00aad01fdb1e13fd69a55b8b2a3b7a2c314c1ccbfc18284293f06ff5e875f0b64a86054db404

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmfc.dat

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      3KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b1d697cf9f0f62da5fd4610e41013d57

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b4a17cbcd2cee6dc52fca7d4d44d6a33006dc1df

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      caf71d4549632faa6e3b6c4c034b62eb730e2547ad4e603a3d8356a13f59cc4b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      758457068ef524c17089d247e39d23388f3a6a5caf99b56a915ca90a5c7bab80c5616d55bd86da827fcdf7ce010492c01bcd6d883eafdca1386969b4aad0580b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\CHROME~1.MAN

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      bbc14a39b1036a5a55720fb033f5d678

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      e291b498ac75c34b15d0b9ac976ad84561d7d13d

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9f049ccb3aa99c45b04b45fc4b6d25b9acb22210b5e953ee35cbcb1d15084b70

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      c5861de0225f53a4045570586b7849d55ba3b0732da2c9c59e2b6c33a38ecd47323fe14022e5ddbd7bde7e500a3f71144957d143d3e243d5edcef65a351f6df8

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\IDMHEL~1.JS

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      17KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      2a20155907354d73043a2070b009dc88

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      cdc3332ed63056792122a91760d79f87376a9b95

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      038b464b3e07f0810d78d6cfacb2ad7046da4eb691fc357907c4b02c76dde5e9

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      0efd0df6fbc0d57fcb3196f7a3bf63e79ee29c91edb47f2f6db072a8a10bcd4420b92b9d51fd809e5ff99b425a0cd3970f145397850ac3f6d615760af762978b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\IIDMHE~1.XPT

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      2add675cc49ce3e2fc56521a9fc649dd

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      085d971e95c75e81e46f876ab88c0fe7b832f67b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      5bb993f4a7b7aaff7814f25fa3e935d99e7446be1304dd8c2873643f2b97667e

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      fecda2c9f5dfc7fdf5b5d2033a5b4448d0844152e150b30871a75625f9f729136e645f1ea6112e2295741a8851f559f187531093a12da9965e8bdf4c36a7d511

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\iIDMMzCC.xpt

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      569B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      03578f7e2125cd5075c04c373012360b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      09126b32f41f6951af85f380f49b59eccdd4fbb2

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      4fdd09827e9a971c5fed06cad46cec79365f522e6cc280c58982051907538f4e

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      c683125a43bee164f2748b0673489be132eaa6147f6b2a71b7bedc99e251e687d731b978519c5aa873ca90873318884b4dcb7c0b99446d20db15a03d5052962d

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~1\idmmzcc.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      33KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      f4cb6977facfd7c51c5ae061b1d4289d

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ef84d39ccf82313f2c061862b61e2f409f09314

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      92b753d1e48230b3fc5d1ab3afd4353273d08f1a4bdea520df0087318a6c0ff7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      5be7b577d43bc7782356d99816bec9869c0a358e3ef52da3b3ce500e82c6406c76c62a32e225450d7d04ca6ae072418639632f3fe2d201c4ef62e31237dddac9

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~2\IDMMZC~1.DLL

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      31KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      11dad11f8cc43abb1eb8a83e6c0ed317

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      8fa273c2b0f7290c59efc14613951b48a25d6b5f

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      721aa5f82a1bab41544b8317e2a80e94e41dfc882f4a6ef1c42500c8c496f5ae

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      673ece7db412daeda295c6eda3714ed556fced0465ced5dfe221a31bf1a66c4ac9daa79e4290d528a152e5d8b5940a39e7977c7b53eede12693207deb4e79ebd

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~2\idmmzcc.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      26KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      084ecdf58f4f694777d38a588a54b56a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      2b06616643cd096f7467e387b9df2b748d91885c

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      4b924f07115ab9a2f2d7a83a878a692f7880d62cfad6145c86bd53548d10821f

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      575b609c20e541e4f37e5d61d3dcbfd894c0a4af9ac678a80545e4a9947d3cbf745033663c5a32267407a67aa50219adc586b690e3de3c2bc39d4c4862349402

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMCCH~1.DLL

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      326KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      36b618f848d6dda620bf0b151eacf02d

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      fce4b8bacd1b764c01051603e6548f8b458ee2b8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      1450146b904919474ef6d528b20a672a33a32afc4a1e40f69d515b523d72fa19

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      b5cbadaa41ac4cfd634c6a7546a4d25116ea33b88f9d5136f2b8982299f3dc50b18b01b0afde4efa4a0fa28b48d539a4039196d9a983c43b4b4cd8395ec4d31b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMCCH~2.DLL

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      451KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      5012ea14f13dd58ffeb14553824d8ebb

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      416009ed1d66d9e19e6a5d0e45f90923892c94e1

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      59ac02f5a0644bf56b7ad7e2b48fc8f89083f8cfe12a0a93f63163a5573a876f

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d86880353c24cff8580b799afcbe3e5319a2d454bb72fdad37f950d4470b51b3adf46e685bcae49111de6864543d5a51a6849e804cd32e292cabdb6d9c443617

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMHEL~1.JS

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      9a835016af8ab4355ee1233e7561a86e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      15d2b0f0c45649a14e537903f45766411edda2a3

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      c435a45c3a3e1d7c208dda4cd47377416772fcaa274aa2e48bc1322a7c1fdc6b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d621f865b1d5ecd0cc3fb293cb590da7931ecb9d008ede891b183aebc2a232d97a50c9ac72c25c76de10eee3706afb06c6eef7ddd489e77bad0982e2f6f139cf

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IDMMZC~1.DLL

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      27KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      8b640fb5a8a1a7358ae8beaa7c208d9a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      685ffdfeb8fb5d0e43ab0124554015bc261ce1ba

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      132591d6563f9bb425edf9604ed1886809c7856bc203d3af71c1af932befc70e

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      db37ff023b21fc58f860adabc14ad030d584f45cfb6d9c284bcaa123c417c12cd7c0c26e199541b28464ba8a80f00d3bfa22837a7dcbbdde576f111867e19833

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\IIDMHE~1.XPT

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      331B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      1429ed34a62d6111144e44b8dabf165d

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      c5a88c1969047c65856486ccb489810925073e1d

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      0e2315ea37b8c7116254a4c53294eec13ebd2596d8205a8999051728e026cc0d

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      f4585a6b2508d04e23697655916086cf3506d5c2e79506334f1105bce1d39e7406eae3f09ed1ad4522e2d470e4239f25dbbb2c77261927e6341058cbfb0dc3df

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\COMPON~3\idmmzcc.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      33KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      8fae57c6c9a27c01e9d4591f4e2cd6b2

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      567d21d96d20f350619eb13579f9b556d2419251

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      c9b83ce41312ea7ad7d00a57fc4933c0ef02d5df95bc2326be52b52ae1e15ad0

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      9cd394f0c0583dc631e5d613929bb42a01fde299ff4a9edeb635a886550c31dfefeb4899bf7fe3cdce71d4746185a7a02da0b7c80c36d1e822465f653c264712

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\META-INF\manifest.mf

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      6385dfa9936c206b146e390b9c776a87

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      e80669a3d711138b5a1fe8edb5bd04300afb30f8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      8f33411f05f344dbb2b278ae9e6f7c2c41ab154620ef5b65d2392c3c1740f83f

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      09088fd4cec9cbc8c9f9167707465ded4bfa2434d4963064e80ea39a061c863e2449fcf2ceaa412de4c03dec845c570ff8d8d3bd73f6e5e8bcc8987bc80d8d68

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\META-INF\zigbert.rsa

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      0c24a5190f932c3fc2b12b879c230bfa

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      fd4d35df7b997ac545c6786667610c5ee9bd55c5

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      1d096ea115ec7cbf3cd66fa2911c8e655e939d9c00a5abb6625504f14cc7c85a

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      7c2827546ead153febaadd4428dd9c54435e3f7013cb9c605370a7c813320369379380e3232134bef5a074ecf2d08f3ab1a7d32ccc528e6205c3efc6440a5c03

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\META-INF\zigbert.sf

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      194c81e95e15bee24ef8818e9f1da141

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      a1ef6ddc40bf88cc99128cdefddb40d562c48bbf

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      eefd986b8fe74645cec660746c189cffadbc9269d804809fbd09615a662c0ab7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ffa098a8afb5b1a7e3550ed4569395032f20f4382654f1bf0cd487bb349af8b8df9f22dca76530ebf93b4c145021e1c285d75bba1111d03a2e3437e485bd1ba6

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\chrome\idmmzcc.jar

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      5KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      191be8f3b55fe69e2dac9fe6810252f5

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      fd8a6e8b439eceb934cc5ebf75185e6473f4db6b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      562269a4b8887831450ee7deb0d3f30a1424f73499b2ae062e63c6841063efa9

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      515b712377796c0b699a8770c392b9cb82d14f36078d0c63eaf32c5641b3d1d901bd58c91681dead2cce3ef10c4710a5a08793f809cc24b9a13dec6e0e538e98

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\icon.png

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      a647e3e381c7e5f60cb1d81075884177

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ba1b6d20c18b87894bbeab8e06b22bb4798d5eb8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      24026ee7bd835c331ef466b1b2083116fa67d996805de53f7b1e92af9b57f81b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      b5cf6ae6d6d344871177287cef639bba8129ab59cb04a362792548e5e8f0514cbd5d1cfb8e11f65a047dee6484c4ec8de3c9f2f28fd6c5d49768a352137b539f

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\install.js

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      700B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      3af40e8c059c4b706df4af244373fd82

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      d32b291922fd8d5004574558650a3d38af5fe3ff

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      20dd9541048e3c2bc5ca26b491cd273df9af2e3b3f30d8c8bcf17ea17cb5454b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      2fcdaa6064864c98d051f0563e07ae73777f88bd0225e87251d262a9a502cb56becdd36286ef9d37c630da845fc1393f05c6fcd065b8271222ef977f4127f02d

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\install.rdf

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      f87821598fe5b270d1dab741733c5703

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ec34c93b8cb1679b1d9c9277c0f8233bd9223ed7

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      a4e709069b95e4fa4bc17d65a028e91a7f1ea3ef9ca0ed22ce4b704f3307ba52

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      06654c98c0ba9fee92de469f833d3fa989cb1deba92c319e3c8057d839fb4b6250e61f5e1d8b5c4a22c24926bec9209bfd64651ee6335ff2f05271f98e75e1f6

                                                                                                                                                                                                                                                                    • memory/1468-30-0x0000000003E80000-0x0000000003EA9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      164KB

                                                                                                                                                                                                                                                                    • memory/1468-31-0x0000000003E80000-0x0000000003EA9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      164KB

                                                                                                                                                                                                                                                                    • memory/1468-28-0x0000000003E80000-0x0000000003EA9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      164KB

                                                                                                                                                                                                                                                                    • memory/1468-29-0x0000000003E80000-0x0000000003EA9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      164KB

                                                                                                                                                                                                                                                                    • memory/1924-32-0x0000000000870000-0x0000000000880000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/1924-37-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      164KB