Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250610-en -
resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/07/2025, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe
Resource
win11-20250610-en
General
-
Target
2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe
-
Size
11.9MB
-
MD5
0f57924ddfed66ab424aa46d47be0828
-
SHA1
812eded4562ce1aa45095522a4918e90fedb3eb2
-
SHA256
c306ae8692b0d6a8452fef14695e3ce3d372a9ce425319ebbeab468ebb1def02
-
SHA512
2c06f9aa212951cde4cb564c49050f81c9d284853ba14a962fcbcb58198c0b4df9f6c49f6399f4e524c90013df754cc7a800a4910a3c3050172311824a63639d
-
SSDEEP
196608:5X5pDStUHl2BAXdApST0+/WFNWcfQyaPVUczzUrexfwdNZGBAcBcD2peihgJaFjA:/lkBaAmzuWfnyeuTZgcKp9k6A
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\idmwfp.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\idmwfp.sys DrvInst.exe -
A potential corporate email address has been identified in the URL: [email protected]
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 15 IoCs
pid Process 4152 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 668 icsys.icn.exe 4940 explorer.exe 5048 IDM1.tmp 4976 spoolsv.exe 5272 svchost.exe 2404 spoolsv.exe 1992 explorer.exe 4948 svchost.exe 796 idmBroker.exe 2848 IDMan.exe 5152 Uninstall.exe 2484 MediumILStart.exe 6128 IDMan.exe 3720 Uninstall.exe -
Loads dropped DLL 39 IoCs
pid Process 5048 IDM1.tmp 5048 IDM1.tmp 5048 IDM1.tmp 5048 IDM1.tmp 3772 regsvr32.exe 5872 regsvr32.exe 5288 regsvr32.exe 2324 regsvr32.exe 1592 regsvr32.exe 3700 regsvr32.exe 2848 IDMan.exe 2848 IDMan.exe 2848 IDMan.exe 2848 IDMan.exe 2848 IDMan.exe 4904 regsvr32.exe 5268 regsvr32.exe 1128 regsvr32.exe 4964 regsvr32.exe 5176 regsvr32.exe 5064 regsvr32.exe 5060 regsvr32.exe 2964 regsvr32.exe 3300 Process not Found 3300 Process not Found 3744 regsvr32.exe 3376 regsvr32.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6064 regsvr32.exe 5920 regsvr32.exe 4776 regsvr32.exe 5184 regsvr32.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Program Files (x86)\\Internet Download Manager\\IDMan.exe /onboot" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" IDM1.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" IDM1.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" IDM1.tmp -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\SETF6A6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File created C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\SETF695.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\SETF696.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\idmwfp.cat DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.cat DrvInst.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\idmwfp64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\SETF696.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\SETF6A6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\SETF695.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c7628e82-f492-cc44-b8f6-df12b6754481}\idmwfp.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_large_3.bmp IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_th.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_es.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmcchandler7.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMSetup2.log IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_cz.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_sk.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMShellExt.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idman.chm IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmmkb.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_src.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_cz.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_cz.txt IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\scheduler.chm IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_iw.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmvs.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmindex.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmvconv.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_gr.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_hu.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_hu.txt IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmfc.dat IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_ug.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IEGetVL2.htm IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_style_3.tbi IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_pt.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_bg.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_sk.txt IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmnmcl.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_kr.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_chn2.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.json IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMEdgeExt.crx IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_mm.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_sr.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmcchandler2.dll IDMan.exe File created C:\Program Files (x86)\Internet Download Manager\idmfsa.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_th.txt IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMFType.dat IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_sk.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMan.exe IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmwfp.inf IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmtdi64.sys IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmcchandler2_64.dll IDMan.exe File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_fr.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmtdi32.sys IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\IDMOpExt.nex IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_sw.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_ge.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmantypeinfo.tlb IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_ptbr.txt IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\idmwfp.cat IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\idm_pl.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_fa.txt IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\inst_dk.lng IDM1.tmp File created C:\Program Files (x86)\Internet Download Manager\Languages\tips_vn.txt IDM1.tmp -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log RUNDLL32.EXE File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\INF\setupapi.dev.log RUNDLL32.EXE File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 50 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idmBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDMan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediumILStart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDM1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDMan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe -
Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" idmBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDM1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" IDMan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Program Files (x86)\\Internet Download Manager\\IEExt.htm" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDMan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} IDM1.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDM1.tmp Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" IDM1.tmp Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B} idmBroker.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} IDMan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\Policy = "3" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights IDM1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy idmBroker.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\AppName = "idmBroker.exe" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\AppName = "IDMan.exe" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights idmBroker.exe Key created \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\Policy = "3" idmBroker.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32 IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM integration (IDMIEHlprObj Class)" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7798BD6-34AF-4925-B01C-450C9EAD2DD9}\ = "IIDMHelperLinksStorage" IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor.1 IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC69364C-34D7-4225-B16F-8595C743C775}\TypeLib IDM1.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}\ = "IIDMEFSAgent3" IDMan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42FD0451-B21A-4EE0-8B4F-6F2DA05F6FD1}\ProxyStubClsid32\ = "{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" IDMan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47} IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\TypeLib\ = "{3BDFC55C-ED33-43BB-9A77-57C2AF4B56EF}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\ToolboxBitmap32 IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}\ = "IIDMEFSAgent5" IDMan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage.1\CLSID\ = "{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}\1.0 IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\TypeLib\ = "{37294E01-DB54-43AF-9D50-93FF7267DF5D}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42FD0451-B21A-4EE0-8B4F-6F2DA05F6FD1}\NumMethods\ = "18" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Internet Download Manager" IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33AEF752-FB86-4787-9ED1-6010528F5FA3}\TypeLib\Version = "1.0" IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A89524B-E1B6-4D71-972A-8FD53F240936}\1.0\FLAGS IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}\1.0\0\win32\ = "C:\\Program Files (x86)\\Internet Download Manager\\idmfsa.dll" IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMIEHlprObj\CLSID\ = "{0055C089-8582-441B-A0BF-17B458C2A3A8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMHelperLinksStorage\CLSID\ = "{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\InprocServer32\ThreadingModel = "Apartment" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor.1\Insertable IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}\ProxyStubClsid32 IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\TypeLib\ = "{6A89524B-E1B6-4D71-972A-8FD53F240936}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\VersionIndependentProgID IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Version IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMGetAll.IDMAllLinksProcessor\ = "IDMAllLinksProcessor Class" IDMan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM.dll" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor\CurVer IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47} IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\ProgID IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}\NumMethods\ = "14" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\ = "IDM Shell Extension" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\ProgID\ = "IDMGetAll.IDMAllLinksProcessor.1" IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7798BD6-34AF-4925-B01C-450C9EAD2DD9}\TypeLib IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7798BD6-34AF-4925-B01C-450C9EAD2DD9}\ProxyStubClsid32 IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}\TypeLib IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8} idmBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32 IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}\TypeLib\Version = "1.0" IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\ = "IDMHelperLinksStorage Class" IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\ = "VLinkProcessor Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\Elevation\Enabled = "1" IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038} regsvr32.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe 668 icsys.icn.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4940 explorer.exe 5272 svchost.exe -
Suspicious behavior: LoadsDriver 12 IoCs
pid Process 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5048 IDM1.tmp Token: SeRestorePrivilege 2848 IDMan.exe Token: SeAuditPrivilege 3420 svchost.exe Token: SeSecurityPrivilege 3420 svchost.exe Token: SeRestorePrivilege 1648 DrvInst.exe Token: SeBackupPrivilege 1648 DrvInst.exe Token: SeDebugPrivilege 4496 firefox.exe Token: SeDebugPrivilege 4496 firefox.exe Token: SeBackupPrivilege 2848 IDMan.exe Token: SeDebugPrivilege 5920 regsvr32.exe Token: SeDebugPrivilege 5920 regsvr32.exe Token: SeRestorePrivilege 2044 DrvInst.exe Token: SeBackupPrivilege 2044 DrvInst.exe Token: SeDebugPrivilege 1728 RUNDLL32.EXE Token: SeDebugPrivilege 1728 RUNDLL32.EXE Token: SeDebugPrivilege 5184 regsvr32.exe Token: SeDebugPrivilege 5184 regsvr32.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 2848 IDMan.exe 6128 IDMan.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2848 IDMan.exe 6128 IDMan.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 668 icsys.icn.exe 668 icsys.icn.exe 4940 explorer.exe 4940 explorer.exe 4976 spoolsv.exe 4976 spoolsv.exe 5272 svchost.exe 5272 svchost.exe 2404 spoolsv.exe 2404 spoolsv.exe 1992 explorer.exe 4948 svchost.exe 1992 explorer.exe 4948 svchost.exe 2848 IDMan.exe 2848 IDMan.exe 4496 firefox.exe 2848 IDMan.exe 2848 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe 6128 IDMan.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 4152 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 81 PID 2932 wrote to memory of 4152 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 81 PID 2932 wrote to memory of 4152 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 81 PID 2932 wrote to memory of 668 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 83 PID 2932 wrote to memory of 668 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 83 PID 2932 wrote to memory of 668 2932 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 83 PID 668 wrote to memory of 4940 668 icsys.icn.exe 84 PID 668 wrote to memory of 4940 668 icsys.icn.exe 84 PID 668 wrote to memory of 4940 668 icsys.icn.exe 84 PID 4152 wrote to memory of 5048 4152 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 85 PID 4152 wrote to memory of 5048 4152 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 85 PID 4152 wrote to memory of 5048 4152 2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe 85 PID 4940 wrote to memory of 4976 4940 explorer.exe 86 PID 4940 wrote to memory of 4976 4940 explorer.exe 86 PID 4940 wrote to memory of 4976 4940 explorer.exe 86 PID 4976 wrote to memory of 5272 4976 spoolsv.exe 87 PID 4976 wrote to memory of 5272 4976 spoolsv.exe 87 PID 4976 wrote to memory of 5272 4976 spoolsv.exe 87 PID 5272 wrote to memory of 2404 5272 svchost.exe 88 PID 5272 wrote to memory of 2404 5272 svchost.exe 88 PID 5272 wrote to memory of 2404 5272 svchost.exe 88 PID 556 wrote to memory of 1992 556 cmd.exe 93 PID 556 wrote to memory of 1992 556 cmd.exe 93 PID 556 wrote to memory of 1992 556 cmd.exe 93 PID 4308 wrote to memory of 4948 4308 cmd.exe 94 PID 4308 wrote to memory of 4948 4308 cmd.exe 94 PID 4308 wrote to memory of 4948 4308 cmd.exe 94 PID 5048 wrote to memory of 3772 5048 IDM1.tmp 97 PID 5048 wrote to memory of 3772 5048 IDM1.tmp 97 PID 5048 wrote to memory of 3772 5048 IDM1.tmp 97 PID 5048 wrote to memory of 5872 5048 IDM1.tmp 98 PID 5048 wrote to memory of 5872 5048 IDM1.tmp 98 PID 5048 wrote to memory of 5872 5048 IDM1.tmp 98 PID 5048 wrote to memory of 5288 5048 IDM1.tmp 99 PID 5048 wrote to memory of 5288 5048 IDM1.tmp 99 PID 5048 wrote to memory of 5288 5048 IDM1.tmp 99 PID 3772 wrote to memory of 3700 3772 regsvr32.exe 100 PID 3772 wrote to memory of 3700 3772 regsvr32.exe 100 PID 5872 wrote to memory of 1592 5872 regsvr32.exe 101 PID 5872 wrote to memory of 1592 5872 regsvr32.exe 101 PID 5288 wrote to memory of 2324 5288 regsvr32.exe 103 PID 5288 wrote to memory of 2324 5288 regsvr32.exe 103 PID 5048 wrote to memory of 796 5048 IDM1.tmp 102 PID 5048 wrote to memory of 796 5048 IDM1.tmp 102 PID 5048 wrote to memory of 796 5048 IDM1.tmp 102 PID 5048 wrote to memory of 2848 5048 IDM1.tmp 104 PID 5048 wrote to memory of 2848 5048 IDM1.tmp 104 PID 5048 wrote to memory of 2848 5048 IDM1.tmp 104 PID 2848 wrote to memory of 4904 2848 IDMan.exe 105 PID 2848 wrote to memory of 4904 2848 IDMan.exe 105 PID 2848 wrote to memory of 4904 2848 IDMan.exe 105 PID 2848 wrote to memory of 5268 2848 IDMan.exe 106 PID 2848 wrote to memory of 5268 2848 IDMan.exe 106 PID 2848 wrote to memory of 5268 2848 IDMan.exe 106 PID 2848 wrote to memory of 1128 2848 IDMan.exe 107 PID 2848 wrote to memory of 1128 2848 IDMan.exe 107 PID 2848 wrote to memory of 1128 2848 IDMan.exe 107 PID 2848 wrote to memory of 5064 2848 IDMan.exe 108 PID 2848 wrote to memory of 5064 2848 IDMan.exe 108 PID 2848 wrote to memory of 5064 2848 IDMan.exe 108 PID 4904 wrote to memory of 4964 4904 regsvr32.exe 109 PID 4904 wrote to memory of 4964 4904 regsvr32.exe 109 PID 5268 wrote to memory of 5060 5268 regsvr32.exe 110 PID 5268 wrote to memory of 5060 5268 regsvr32.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe"C:\Users\Admin\AppData\Local\Temp\2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\users\admin\appdata\local\temp\2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exec:\users\admin\appdata\local\temp\2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
PID:3700
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
PID:1592
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
PID:2324
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:796
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
PID:4964
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
PID:5060
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵
- Loads dropped DLL
PID:5176
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
PID:2964
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html5⤵PID:2080
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html6⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4496 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {00119b70-5ba1-4229-b521-fad7eee72dac} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu7⤵PID:5080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {a39f14c0-a71c-4f80-bfa8-4407b08c3115} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket7⤵PID:5000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25164 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {d2ec6e0c-e2e2-4bcf-96b0-6a55bce43f28} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab7⤵
- Checks processor information in registry
PID:6120
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {a574a0f3-adf5-409b-813b-7898c2306727} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd7⤵PID:1388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 34773 -prefMapHandle 1540 -prefMapSize 270279 -jsInitHandle 3304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3192 -initialChannelId {6d4631ff-04dc-429a-9b0f-a2219b03b258} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab7⤵
- Checks processor information in registry
PID:3104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35010 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {7b01ef5b-f692-4b44-b18a-493049e942da} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility7⤵
- Checks processor information in registry
PID:1444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 35062 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {6a397be7-c804-46b1-9722-a590ee65b54a} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab7⤵
- Checks processor information in registry
PID:3972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 2460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {1db4c0d8-c0a2-46fd-afcd-48abdda61112} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab7⤵
- Checks processor information in registry
PID:3536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 32952 -prefMapHandle 5776 -prefMapSize 270279 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5788 -initialChannelId {199f7337-3f23-44cf-9be9-cdf3c1a746f4} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab7⤵
- Checks processor information in registry
PID:1860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 32952 -prefMapHandle 5988 -prefMapSize 270279 -jsInitHandle 5992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6008 -initialChannelId {d554fb85-03e6-4b1b-9636-df4138c3e71c} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab7⤵
- Checks processor information in registry
PID:1700
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf6⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1436 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r7⤵
- Checks processor information in registry
PID:1804 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o8⤵PID:3696
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
PID:3520 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
PID:3416
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
PID:4548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
PID:5888
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
PID:4776
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
PID:3100
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3744 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
PID:3376
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO1⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe RO2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c34b8fb7-ea32-864d-8be6-3bf562216f3b}\idmwfp.inf" "9" "4fc2928b3" "0000000000000140" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Internet Download Manager"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3480
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000160" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000016C" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c grpconv -o1⤵PID:2364
-
C:\Windows\system32\grpconv.exegrpconv -o2⤵PID:1300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot1⤵PID:5396
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6128 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6064 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5920
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3720 -
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
PID:3560 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵PID:2624
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
PID:5780 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
PID:1888
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
PID:5820
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5184
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5d04845fab1c667c04458d0a981f3898e
SHA1f30267bb7037a11669605c614fb92734be998677
SHA25633a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
SHA512ccd166dbe9aaba3795963af7d63b1a561de90153c2eaefb12f3e9f9ddebd9b1f7861ee76f45b4ef19d41ca514f3796e98b3c3660596730be8d8eb9e1048ef59e
-
Filesize
93KB
MD5597164da15b26114e7f1136965533d72
SHA19eeaa7f7de2d04415b8c435a82ee7eea7bbf5c8a
SHA256117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
SHA5127a2d31a1342286e1164f80c6da3a9c07418ebeafb9b4d5b702c0f03065ee26949da22193eb403c8aeec012b6f1c5ff21179104943943302972492fcdccc850d9
-
Filesize
463KB
MD523efcfffee040fdc1786add815ccdf0a
SHA10d535387c904eba74e3cb83745cb4a230c6e0944
SHA2569a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
SHA512cf69ed7af446a83c084b3bd4b0a3dbb5f013d93013cd7f2369fc8a075fe05db511cfe6b6afdef78026f551b53ad0cb7c786193c579b7f868dd0840b53dbb5e9f
-
Filesize
656KB
MD5e032a50d2cf9c5bf6ff602c1855d5a08
SHA1f1292134eaad69b611a3d7e99c5a317c191468aa
SHA256d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
SHA51277099b44e4822b4a556b4ea6417cf0a131ffb5ee65c3f7537ab4cdc9939f806b15d21972ea4d14a0d95cf946013b9997a9127d798016f68bcd957bbffdab6c11
-
Filesize
522KB
MD53ffb2e17429f183cd312509ae93eee93
SHA1ed190aa09b5c8f7122afb02dd98c4c56d16f2a67
SHA256836f1f880c0020f2821211c64f35c11c0cf4a044d06d4fa26a9c3c10cc6bd0fd
SHA512bc32e9bca091179ecdad8dac68ff05848f7de0ce954e3fb7509f7a959317e1e7bc2d89d77a6ce3eb2534fa95c651709cc2a483470b2e55cabfc0bf63815d0071
-
Filesize
36KB
MD5a3c44204992e307d121df09dd6a1577c
SHA19482d8ffda34904b1dfd0226b374d1db41ca093d
SHA25648e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
SHA512f700cf7accab0333bc412f68cdcfb25d68c693a27829bc38a655d52cb313552b59f9243fc51357e9dccd92863deecb529cc68adbc40387aad1437d625fd577f1
-
Filesize
5.8MB
MD54bd90f209b82c3ec374c59ec9044118c
SHA110b3d9d45c4de77b997c5f6abeee31dbc6bba796
SHA25611f663edbeea5d54efbdcfd9fa5444ef217b5fc4a844f70c0f5d8455bfee7e25
SHA5121c634160c8e1dc72f19724f784e0ef4ab705d047a940aeb8a9dc1a42bf81181fb479f074b1f9ccccb552f21958c23f9fb28385d8316d7d5b4fc3900dae766c2f
-
Filesize
51KB
MD5d44f8056ffd0f578d97639602db50895
SHA158db1b4cae795038c58291fa433d974e319b2765
SHA256a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
SHA512e38f4cd19f3a5a227f2a15ff4f5c360125393980812969190435420fde90b5b25ec13c4f79ae5d4bf02f4bdb043a9d9e9e59ee92ca01ce1fcb1fbf327e37996f
-
Filesize
197KB
MD5b94d0711637b322b8aa1fb96250c86b6
SHA14f555862896014b856763f3d667bce14ce137c8b
SHA25638ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
SHA51272cdb05b4f45e9053ae2d12334dae412e415aebd018568c522fa5fe0f94dd26c7fe7bb81ccd8d6c7b5b42c795b3207dffa6345b8db24ce17beb601829e37a369
-
Filesize
155KB
MD513c99cbf0e66d5a8003a650c5642ca30
SHA170f161151cd768a45509aff91996046e04e1ac2d
SHA2568a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
SHA512f3733ef2074f97768c196ad662565b28e9463c2c8cf768166fed95350b21c2eb6845d945778c251093c00c65d7a879186843eb334a8321b9956738d9257ce432
-
Filesize
153KB
MD5e2f17e16e2b1888a64398900999e9663
SHA1688d39cb8700ceb724f0fe2a11b8abb4c681ad41
SHA25697810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
SHA5128bde415db03463398e5e546a89c73fff9378f34f5c2854a7c24d7e6e58d5cdf7c52218cb3fc8f1b4052ce473bb522a2e7e2677781bcdec3216284f22d65fc40b
-
Filesize
90KB
MD579fef25169ac0a6c61e1ed17409f8c1e
SHA1c19f836fca8845adf9ae21fb7866eedb8c576eb8
SHA256801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
SHA51249bf489d6836b4327c6ebad722f733f66722aadb89c4eac038231e0f340d48bb8c4fe7ce70437213a54e21bce40a4a564a72a717f67e32af09b3f9aa59050aab
-
Filesize
20KB
MD5e7ca61c2ee52033e38d6a4d607472e3a
SHA10fe77bd275f3e8a36ed1335e968d6bc11deda6ba
SHA256a2e28177b51a556742a164955f8b62dcf2bdf848c2f6907fea0c92ee8e4ccddd
SHA5127cc8a42e8eaa0a46d4cfdb1d22de234e3004e7e46dd196b7fefc315faaa48ceb6eb7faa6d4b0d6ce2e6f269f163cf80c37f68a3e8e8a3b56f914080d9ca824aa
-
Filesize
8KB
MD52f35eb57142b74c4abe963bca15390ed
SHA1682a5f25d54b37bcdb72eb8a86a74a23878e16a6
SHA2569071d9f117ddf8724b129935ea8b4e989704a50c482add2f6b5f723252d46aaa
SHA512d35e1dd34b49ebf8c75816597461e4d6300f53436b3c51e8626ba42775dd54262ab651205ea9966679cbef4c3decac8a528ee6a03e9e3ae978c9a4134937eae1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\activity-stream.discovery_stream.json.tmp
Filesize28KB
MD58664815c3c602cc6ca8f33ec6ce2b236
SHA12878c8799356d8d85e2307e1046a227cdd86f4d5
SHA256d02109f9451dd8a4a3bad1059fab9d06726563a9587bd19da320cb3edd964a12
SHA512d75ffcc5838c6821c21b6ac528393d4e07a9521e50e6351a50c2714ab8b15edeb5cbdce36585e804f547880c8f3051f4b89a6cff9028e224720a71a5f08327ec
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\cache2\entries\C9AD8D046AE823121AEB5E0FE6D1B61D65686C5C
Filesize13KB
MD50a9a836e6c13332fe388b183a97b4e9f
SHA11cecbf6f83a8994d5d63b4569bdaec26a8371dcd
SHA25646fd26ca5870f9aea7bc36c90673f30932e3567a50cb37c4374856e2c97cdab4
SHA51204117d4436bc22989f5d2b957c397abd02f8404bd7c9a532397cf3900a345c9a088602be0900684391bd423040b09ee97a47519041b09be342d5979474a3f915
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\cache2\entries\CD39AD244C65ED2DD0F139D0BABEEB26DFBD83CC
Filesize14KB
MD5c4e8a930f5c38d663dc4dcc8f9155d82
SHA1d0c9ae5f1bbda1365fec6006024c173e6763fa66
SHA2569f76f5dcd5d3a6ac0e8a0f6d860ed2cd175b345309d9e6aab2e5bb48889fecd1
SHA512adbc050d843cbf0ae76f894d01d83a609c900808b9a5fd02cbb2fd4efbf8b226ff4cf95be986806f34502d5050458b303c6cf4ff2bbb2f5704d0011778d575ae
-
C:\Users\Admin\AppData\Local\Temp\2025-07-03_0f57924ddfed66ab424aa46d47be0828_elex_rhadamanthys_stop_swisyn.exe
Filesize11.7MB
MD585411533ad487aaae811a7502d6eee15
SHA15579a22f8e415ce186a7f547de47761493e68af5
SHA25628125dfe798eef1bdf40e36ef5ef70573def5f439cfbf673cfc22c3a8cd75610
SHA5124f1e74ac61fc8c8a3c00a6c0f8113b3332468d23ea687a2d496deda9dfa2cab34fc0784cbc6886cbba64bec4eb906f9f93cea572bca479fa3e2c950596e1ff69
-
Filesize
162KB
MD51c734d0ded634d8e17a87aba3d44f41d
SHA14974769d1b1442c48dd6b6fb8b3741df36f21425
SHA256645ee6e64ed04825b25964d992d0205963498bb9d61f5a52be7e76ddb2074003
SHA51220239782f4e30157fdfc02a3793ac7bde7ed74400de4cffa812805d680789ea7be5c2c765924d32f74807d80100cccc14b453d3d7e006dd4aeee60dec98af4c9
-
Filesize
4KB
MD595603374b9eb7270e9e6beca6f474427
SHA12448e71bcdf4fdbe42558745a62f25ed0007ce62
SHA2564ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
SHA512d3987f207ad05e142d864b3ffe4ff6758d22b56f75d60ebcd79e0c760cf27106d7ff74bfbc7569389710e50602d3359b4ab20ddc14fbafcf526478dc85bfe593
-
Filesize
3KB
MD5d0b3f5b0ac6ffe251d2a0d93150cf2f5
SHA1ac3565b7da1198595b587e0a2015bc73be815ff3
SHA256c9a75d2f6a98076c64a823a33bc6e92960f4a54e207505594781d8f35c539f76
SHA5129a0e6f8fa53afecfea7ef4a0500b733306f996c7f4a406573845e6076a47e4c47a6a104b83bafd98adea49705446fd1eb46ae7ee7f2a82456a39fbd28d9d0b85
-
Filesize
11KB
MD525e8156b7f7ca8dad999ee2b93a32b71
SHA1db587e9e9559b433cee57435cb97a83963659430
SHA256ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
SHA5121211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
-
Filesize
502KB
MD5e690f995973164fe425f76589b1be2d9
SHA1e947c4dad203aab37a003194dddc7980c74fa712
SHA25687862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
SHA51277991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
-
Filesize
14.0MB
MD5bcceccab13375513a6e8ab48e7b63496
SHA163d8a68cf562424d3fc3be1297d83f8247e24142
SHA256a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
SHA512d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484
-
Filesize
12KB
MD5d5e0819228c5c2fbee1130b39f5908f3
SHA1ce83de8e675bfbca775a45030518c2cf6315e175
SHA25652818c67be219bc3b05c58b40e51b99a65c2f4bcafe38a995610b4ec10928def
SHA512bb397004f2256db781385de3e7e7b7993be8fbb2cb701ead99a7878c2bcca6c9ae4a7aa61c329aeeb6711c8c74081e971e85af38af6b32b58888c932fd51d218
-
Filesize
169KB
MD57d55ad6b428320f191ed8529701ac2fa
SHA1515c36115e6eba2699afbf196ae929f56dc8fe4c
SHA256753a1386e7b37ee313db908183afe7238f1a2aec5e6c1e59e9c11d471b6aaa8d
SHA512a260aae4ff4f064b10388d88bb0cb9ea547ed0bc02c88dc1770935207e0429471d8cd60fcc5f9ee51ecd34767bf7d44c75ea6fbe427c39cc4114aad25100f40d
-
Filesize
3KB
MD54be225f5ed8575cb3e70847863026660
SHA1852fbb7d2739afe764613d45dc6f2234bc50f213
SHA2569d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
SHA51282ab7efa6f900229d8dae2d72ab039651b8af853b1128b36bf172109f8456c6cd3afdfa3ebbec86624c91cf4db55181bf30befe90195b0f2b7ae782d8e090596
-
Filesize
3KB
MD53cf29c53c8d733d26794661e477fb5b9
SHA194eae66f2a322b5a4c1a6584c036e7b3b88fd2ac
SHA2569efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
SHA5122321fe2f6188cb2590ec2793145f75e1666c41221b29c1d18358311d378f86f2e5a6575028accfc721f9db3e2b27981d857d556bdddd32bf6ea1233af355d94c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\AlternateServices.bin
Filesize6KB
MD519d3c5bb0a7d21cbeceb9261f140b225
SHA1af2fc1064fc202f649f2d47daadfe9ccd94b72f7
SHA256feb1a0f0b6059ea7d9c6135bbc68c04ac9b697685466ac80b190054bc9c288a1
SHA5120a5be74070ddeb5730094c9e853451e26c9f905f2fd881b3c7c7e36c08628128539d0e39a8f927cfca0e3dc1f52372b113e5c5498c6fb024fc7b75f69f7f254f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\db\data.safe.tmp
Filesize7KB
MD565cde86cc7528e46c76e41c2894e0f30
SHA12a56a2c7d3cfb238015925524da750c8116806b4
SHA25613a43cb6f3720d255b5efbfa57737b91980f27e38cc69b6150acd99ebc93e3f7
SHA51205c869bf57ee90a55c3525e3c8c332cac59075f014aefe74078ab3461d734ef3d4359681eb90603e04cdeca9fe91fa31f167f0fc5702c5c7316d6751f072bea3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD511de82a21070cec5851691394f1d0bb7
SHA148d72d06704d7e4be52c09560d68d282adbc1a99
SHA256a6e7f13d9882eba6ac90ca5cdb2ed1a85fbfc93f4ff51de403cff2ce3b5dc3dc
SHA5125073348dc5a65097aa226137dd9af5f950947c429b21da6d7f569abe84876b3ea250f15b54add07b99a83b89e0467b73222cc8d3cdfa857becd4a91274a155c7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\events\events
Filesize1KB
MD575c9a90d31d50362ff6e5a16b26b1263
SHA1387c86df900bc402974bd1c45d7f94b3d912d197
SHA25669fa980e9f470054736a6126db8e98b3de0477083c9f1d9b13f262bedb2ca9e6
SHA512d31f650d1541d88e01c3ef9b8909afb6f38d560a23cd549816528849e9b9622ae98fbab6b708eb6fe90b9ab358e85ab7df9756422ff349ca0e213f2d7dd6169a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\pending_pings\2fbcfb59-974f-469e-a17e-f4466d6adb72
Filesize235B
MD5882ddaac7ca1b80a4f03000f6a4b401a
SHA1f55ddb3de2ea4e6a9cb6d33aae05d3e049a4dc0e
SHA25686707d3376914f73e96c7686a271cfbec46add14e9f52bc6218c4cb726844b14
SHA51242c106149385c6a8f48879faf93a08c8c2d828bbb6fb0df0767aa49a17fbf06cca3f698f7bc6d947c97f8ec5a2d8ad5a166a817b54bfac58b378fb5f1c17770f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\pending_pings\47e469a6-e797-4a6d-b146-2d2160ac9fcd
Filesize883B
MD59c64d252b54d42082a8a3aa620af2ffc
SHA1ed38678c81bf64b34ed96067f1db0f3dc76b7eb2
SHA256f4fa78e90846072783c67db3f784ed9ae0294334463dabbe62a4dd80279f39c7
SHA5129065104731710a7dea1efda00cccc3b579d7ae9930364bc449ff491d1e6ba477a139640fd64f1f565af5614d6b80689f1371c70e9deab0767398ee6723b74f39
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\pending_pings\7526dafe-386a-4e9e-ad17-f6eb747f58a8
Filesize16KB
MD57501a3acd068eac46191ca9b09227b41
SHA1619009f03b43f8d887c7ace96c509f2b56329994
SHA25616bee6b78fb937c7d69cbbb7aa1e690404c3867ea59637d363da7c545ef80394
SHA51238c3e5fc2dd1118e50c1bb08eca41c678eba9d4bd4c84d232524a5802644abaf96117d0ca669dbaaf9e2de828680ccc132cccdb7bd287360e4414f8ca63d4cdf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\pending_pings\960fd46a-94ca-4168-a061-99730e6e1b8d
Filesize2KB
MD5ed2fc5b1076804d2da31f5fbd72cb0da
SHA172cb896c5c16d6f2a14c461f08b0d632dcf26540
SHA2567d2efba485a7abe88176592c15d006ab3cbda101d1db0b2f3b0f7ed4dca1728b
SHA512f416b9d15951f9270bcc900d9cb87476bc0fac3f7538e7d22fa551ceb9f7210b543fefcbdda7bd2e7c222333e28ba70131dddebb69fbb6a5bec6103f69e6c258
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\pending_pings\dfd5c8e0-f2fa-42ab-b42a-520210a0f566
Filesize235B
MD5c4e6b2d43039f4ffadcbab26bc24cc37
SHA1e36a328f0cbe528252b775f142f97ccee00cfaed
SHA2568c90d1c491da60da84b42bc8a2eec876fb4ae8e4e4c8c84ffdd01f2e5d490c2e
SHA512ef90d4551490ca3c3852c057a40c33d5fc9b9746ee47dc104f488ff7db862d65bdd0531d8ed3a30309960ef9277facdc95189652aca85048039e38b59698a3de
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\datareporting\glean\pending_pings\eada3bab-ad33-4556-b7fd-dc35193b9ec4
Filesize886B
MD5885d1cc8581c053d006841017ba90ae2
SHA133ba4f79dcd081c25fbd60ba3ed49214de5a7427
SHA256d5a429d6aa9ecc94904bc3f6bacbb92a0f1f565dafae73aa4e412651daae4e8e
SHA512d60a58dd062eb83149f30dd104be004720485d8a063c6b02829a36aaa0afda68d27e07746d96654ec8287a229890d067e86fe7968eb49086b001f9c73b3d0e23
-
Filesize
16KB
MD5787083013dad681c36c22872f4804ae3
SHA1570bab6e943a633b18c1394ffb21d0e5625a3df4
SHA256254d41e96520b40cda5795f11d259a4bd296a6a692561d1d095c757c006538c1
SHA51260795c4ec98ac8d6dd8d0ace9aa670b1bd637a34ced64bee5699fd171c037c269cafcc82036462982e0758017cbcf2d2b704804c360cbeda9e716dc1968d4445
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Filesize1.1MB
MD5626073e8dcf656ac4130e3283c51cbba
SHA17e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA25637c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
SHA512eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Filesize116B
MD5ae29912407dfadf0d683982d4fb57293
SHA10542053f5a6ce07dc206f69230109be4a5e25775
SHA256fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
SHA5126f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
Filesize1001B
MD532aeacedce82bafbcba8d1ade9e88d5a
SHA1a9b4858d2ae0b6595705634fd024f7e076426a24
SHA2564ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
SHA51267dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
Filesize18.5MB
MD51b32d1ec35a7ead1671efc0782b7edf0
SHA18e3274b9f2938ff2252ed74779dd6322c601a0c8
SHA2563ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
SHA512ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499
-
Filesize
6KB
MD51bf38a1c823503ce9d5b34d4a079ddc6
SHA10456079684f71cf084f0766a4bca9873e783d75c
SHA2565fb30626b584d410cd453d504ed64163fff783c0f6f69e2b0407ef5685632c6f
SHA51269599ad67e79c19d71c766e465577771d640ab8b57be9106144768ffacdb02502cfe2acf02e8f0217cbc0c79d900ec2d29f73c98905185dc01f59e105d44258f
-
Filesize
8KB
MD55baa9f820890be83be5ca3443cf6bf29
SHA158d08b858d818ac7f097e889283aab7a8cdadc6f
SHA25641c0d0b541017cae3dc9cce13ee532a2538c3d32d86c8413e944ad325c1db358
SHA51276531ad1a0504dc48cb0bd50d1dc0ca77663f7dac42c67ff9e434894b1c729cb177c3593a50f83ef4e8db05acfaefea2d21adfffc4c8793a3aa057412ae45a18
-
Filesize
6KB
MD559e604c7323953f216ef804ef810fe30
SHA176d1db0fd0eb4bd676a9b8b1a694deac60cab0cf
SHA256b4bcb578a958c410ebbea6ad2e8f61da44474e93429cdd87ca89c2cf67270dbc
SHA512a7b5847c1c8a8038a95b1df0b7c85404262f26848802a583282cf9b766ac2dbf0ed999e99615628e5d5a259bf79902fd1a765d8938db51b71b759868299a5a12
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c8mmgl7g.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD59fb9d1f943f1443767123115cde20463
SHA1cfdfd689cae9b6920701ae982311b6c86e1d2cd7
SHA256f78fd41d3ee916c99404e7a0c96d2a7f4fea505bca40ec6ddccb03cddebd6905
SHA512ea4ee3113779f6dbab4c3d91fdfbfc5daa5ea84b1902fb2d5dc84e59ec5de71ef373a76a7a289c9556d1ec951ca129e303ef7cb0ab166cc9b1fddfa7ce8711a6
-
Filesize
135KB
MD5a6bce5f918100ec53d5608957d59aec0
SHA14184e0a0da1cc14fda402e1956922e019833f035
SHA256c1b4ffaf69c21c4f37ef911b4b68439a8341013320ad40bbec24a9ef23a65bb2
SHA512f83131d6d202030973d27e9805fc964c70e39e0f9b2736d36a3bc491c70478511046c2b690b5ca909b822b10f90381fc35c4e5da9b857214b9f344545c2b5c55
-
Filesize
135KB
MD5b6c42a057794db20c7c2f59861879bf0
SHA1cf8af3c20e5239d21ef50c980871f4f275157a99
SHA25638cd5fa4d593c4b3907e28c29071ff05c75be65ed6a21822ef89a7b75fb94302
SHA512c91e6b2ab85169bd2d29bfbf7ecb48bba2a5744146cdb2879e41c7736b109541165d716c769f2c9cc0ddd524283823c0062823f517f7a2fd33240243a83ff329
-
Filesize
135KB
MD5bc243f288bde741d11357be7adcd03c2
SHA17bc2dc8cb74e9f2c2da9f58fe2250d5bb3e5444a
SHA2565f53d3c45676d04bf76fb503635a9f914ca916ab3706f4a374eda040b4d7c9ad
SHA51223a17d2e10ec0270cc98b1685b2d6f62d6f38603e8349ea4e042d556b8faeefd40a94238a74785f13fae5cf854e4403ac8d0e295594df605a9ac90b97b90ebfe
-
Filesize
135KB
MD559a2bc12e5ecc17d82715111b832d309
SHA17fde930d3f64300f6fbc686fda2379b6070e6f3c
SHA256fec66ea24cc39b54ba7ec5fc79593373183c7ba36d24d6a18694ed9d8be6524c
SHA51210e77ba82e03f8371ea5a4f9932d6568a3fa2e649d84b34f5967d5765a970577eeb1d74615b02116fefb8a077a77bb0e3d260c8b6de498c8cdb00bce4f2fb798
-
Filesize
2KB
MD5f8f346d967dcb225c417c4cf3ab217a0
SHA1daca3954f2a882f220b862993b0d5ddf0f207e34
SHA256a54e0ac05254a464180e30f21a6b26651e7495427353bba9c246ba1d2388e7cc
SHA512760c2914f3e937a2a3443a032cf74b68b6d24d082d0f50d65058a0fd87d8eeab229fb8d3105e442f0b3b0b2f3824439981951266425512e51e7ff36669a652fa