Overview

overview

10

Static

static

3

2026-04-21...yn.exe

windows10-2004-x64

10

2026-04-21...yn.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe
  • Size 11.8MB
  • Sample260421-eqhzkshv5n
  • SHA256 0cd79ede283ad757cbc2a167d27e68e49a8657997265f94c2efb78ad9f0d7f54
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencephishingprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4256
    • \??\c:\users\admin\appdata\local\temp\2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5292
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:992
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4796
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            PID:1756
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4396
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:6000
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              PID:5156
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3460
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:3168
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3644
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              PID:4660
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5988
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:5012
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1868
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              6⤵
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4216
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {daabc189-52bb-4dbe-8fb5-fe59f4c78de2} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                7⤵
                  PID:3776
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {2c681d9c-f5a4-4b40-8098-4891e9537605} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                  7⤵
                    PID:220
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25164 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {1744b40b-38a3-4456-8311-81d86fe7523e} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                    7⤵
                    • Checks processor information in registry
                    PID:1352
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27276 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {80ba7e3f-65bf-47de-a919-ce69fef51eae} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                    7⤵
                      PID:5136
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1672 -prefsLen 34775 -prefMapHandle 1676 -prefMapSize 270279 -jsInitHandle 2872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2884 -initialChannelId {714b2be2-bc59-43bb-a75a-30bec988c1a4} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                      7⤵
                      • Checks processor information in registry
                      PID:2016
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5176 -prefsLen 34905 -prefMapHandle 5180 -prefMapSize 270279 -ipcHandle 5192 -initialChannelId {7587d12c-9a09-45b2-86ae-b1c72417db6d} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                      7⤵
                      • Checks processor information in registry
                      PID:1512
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32952 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 3220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3064 -initialChannelId {bd62c2be-ba39-44d2-b1a0-8e4f16f36437} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                      7⤵
                      • Checks processor information in registry
                      PID:5320
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {4395cabd-c78c-461c-b11a-f730d94cbac0} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                      7⤵
                      • Checks processor information in registry
                      PID:5712
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5740 -initialChannelId {3ddbd251-af37-4437-97cb-7003c217a7bc} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                      7⤵
                      • Checks processor information in registry
                      PID:3200
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 2872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1712 -initialChannelId {fc255c27-a2f9-4804-8c99-c043e15006e8} -parentPid 4216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                      7⤵
                      • Checks processor information in registry
                      PID:4164
                • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                  "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                  5⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4772
                  • C:\Windows\system32\RUNDLL32.EXE
                    "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                    6⤵
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1584
                    • C:\Windows\system32\runonce.exe
                      "C:\Windows\system32\runonce.exe" -r
                      7⤵
                      • Checks processor information in registry
                      • Suspicious use of WriteProcessMemory
                      PID:1940
                      • C:\Windows\System32\grpconv.exe
                        "C:\Windows\System32\grpconv.exe" -o
                        8⤵
                          PID:1768
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:6112
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:2036
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3116
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:3192
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5528
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:1480
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5432
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:2536
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5428
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:1144
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5380
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:3900
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:4224
                      • C:\Windows\system32\regsvr32.exe
                        /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                        7⤵
                        • Loads dropped DLL
                        PID:4492
                  • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3688
            • C:\Windows\Resources\Themes\icsys.icn.exe
              C:\Windows\Resources\Themes\icsys.icn.exe
              2⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4448
              • \??\c:\windows\resources\themes\explorer.exe
                c:\windows\resources\themes\explorer.exe
                3⤵
                • Modifies visibility of hidden/system files in Explorer
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4340
                • \??\c:\windows\resources\spoolsv.exe
                  c:\windows\resources\spoolsv.exe SE
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4548
                  • \??\c:\windows\resources\svchost.exe
                    c:\windows\resources\svchost.exe
                    5⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2964
                    • \??\c:\windows\resources\spoolsv.exe
                      c:\windows\resources\spoolsv.exe PR
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4536
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5996
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0f353997-ff9f-634e-873d-4d628f086bb7}\idmwfp.inf" "9" "4fc2928b3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Internet Download Manager"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:1480
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000158" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:3180
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000015C" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:4144
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:5860
            • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
              "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4076
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4560
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5652
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3560
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  3⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2568
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    4⤵
                    • Checks processor information in registry
                    PID:3708
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      5⤵
                        PID:540
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4816
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4140
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3576
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1132
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2060
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2496
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3504
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4168
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4976
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4188
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5536
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5104
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2572
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      4⤵
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5616

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Browser Extensions

                    1
                    T1176

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Modify Registry

                    4
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    5
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    IDMGetAll.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                    • Size 73KB
                    • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMGetAll64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                    • Size 93KB
                    • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                    • Size 463KB
                    • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                    • Size 656KB
                    • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMNetMon64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                    • Size 499KB
                    • SHA256 2e6263a9eadc4b533e99d5cb7381e774ce24ba1ab6872fd21744a72c43169b81
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMShellExt64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                    • Size 36KB
                    • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMan.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                    • Size 5.7MB
                    • SHA256 0835f094fcef9bc154ea8834578c815e3004a1b1891182f43dc077e17bd5f13f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MediumILStart.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    • Size 51KB
                    • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                    • Size 197KB
                    • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                    • Size 155KB
                    • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmBroker.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                    • Size 153KB
                    • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmfsa.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                    • Size 94KB
                    • SHA256 6f0ed0a7a21e73811675e8a13d35c7daa6309214477296a07fe52a3d477578ad
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmnmcl.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmnmcl.dll
                    • Size 34KB
                    • SHA256 d34f54f994ed5c8398e590ec537f0f2651f0aef51573d3307570917fa8f6e331
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmvs.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                    • Size 20KB
                    • SHA256 e8ab4ef3beff09ba46f5f32c64b392df7e3c4d44f80938726c4a163b1ae4199c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ExplorerStartupLog_RunOnce.etl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                    • Size 8KB
                    • SHA256 3c694d221f4587b92267dbd8f15b701a3d5c8d8a9bbd9406057de9fc4fefc6f4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CD1C116DEEE8F4F97C1806976E10E7E2B349E486
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
                    • Size 13KB
                    • SHA256 dc4dca586bf6e2364ea29c7a0cf7698f74aea7242a62886cc0d8cc494379912f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
                    • Path C:\Users\Admin\AppData\Local\Temp\2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
                    • Size 11.7MB
                    • SHA256 8c2d993b89a21b98d3bfdfa425cde853431f1e5e311954456393b218ab5513ce
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDM1.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                    • Size 162KB
                    • SHA256 645ee6e64ed04825b25964d992d0205963498bb9d61f5a52be7e76ddb2074003
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 4KB
                    • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 1KB
                    • SHA256 2f54d1b1aa5d3fa66798640d7b064ff690b696f4fd2d076fb0404767dcaa82d2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 2KB
                    • SHA256 171e95654d66873fb6b6f600aaec79256f842e4886b8343fb50b9b0dbb16fd53
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    defextmap.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                    • Size 3KB
                    • SHA256 9d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    urlexclist.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                    • Size 3KB
                    • SHA256 9efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 9291257d4931a754943602b60cd71867043e63ec6a487e2f4099eb7c08b321c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 5KB
                    • SHA256 c13b06dc2e9375fe9f9151d4fa79bb757c225a72cb2cc958385dfcc68c72f6e0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 e9fe16434bdddb5472ef92ac6378c8788f40d40f24a430d1857e7b5d61c62744
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    32350f90-e4d0-42c8-91df-7d4df01d54a4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\32350f90-e4d0-42c8-91df-7d4df01d54a4
                    • Size 2KB
                    • SHA256 2f218c70294988ce049eabbc941ef12e56346ca62618e536cf3fb878ce767790
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    53262cfe-a086-4bd8-95e5-c7936d54d0b7
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\53262cfe-a086-4bd8-95e5-c7936d54d0b7
                    • Size 886B
                    • SHA256 bce4af80d7dd806b05af4dc2761d27e67f60084838ee22024d19a570cb4bad37
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    7f37a8db-280e-42c5-983e-b42becaeb854
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\7f37a8db-280e-42c5-983e-b42becaeb854
                    • Size 16KB
                    • SHA256 fee6bdcc1dd9035dfc9b9100d04e18ae513c18005485cb60d5b606e46ea2f597
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    811d0223-77a9-4343-8253-147237dbd523
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\811d0223-77a9-4343-8253-147237dbd523
                    • Size 883B
                    • SHA256 7ad4567338c69c394026777e91a4bd422becd2a03475c2b32de4861dbcd67b89
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    9f346e80-604b-4712-ab11-8afa1e35af8f
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\9f346e80-604b-4712-ab11-8afa1e35af8f
                    • Size 235B
                    • SHA256 f04025ecbf3f20c03c6bb472951ebc540b0c209106f82c872139173ce30b2056
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    c54009b2-bcb8-4e44-82de-1e5b0f69eaf0
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\c54009b2-bcb8-4e44-82de-1e5b0f69eaf0
                    • Size 235B
                    • SHA256 3cef1df6da9353e10888150634ff2b04d2757e4c5912deed28d1ca410af8f205
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\extensions.json
                    • Size 16KB
                    • SHA256 dee43d25a5a6b1600f446aba676a86ddad685720a966b7810cd2c4137a6e4209
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
                    • Size 1001B
                    • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
                    • Size 18.9MB
                    • SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
                    • Size 8KB
                    • SHA256 39be2542f72177bc7b083cf7805c5dcda99d9758b1adecf95bcd909f8cb4ca64
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 52c0073bda0d793cbd18ca3206dc795812a5af31f48dbeeaf0007d271af83236
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
                    • Size 6KB
                    • SHA256 642e3063dd85e24c80656373d6872a370d41cf41eebbb5e2ce51a4c567a3b6e2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
                    • Size 6KB
                    • SHA256 2fcfedbf77ca1621c86ffedb10d793591c8624994f8cdb5fbc73be6f8ab91c06
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 7462151170ffeca00ce4b44c13e89752fb453805a0e941c830952adf92a25b40
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    explorer.exe
                    • Path C:\Windows\Resources\Themes\explorer.exe
                    • Size 135KB
                    • SHA256 627908fcefeb8f23d9864904e46e7fe238ea44be78ce75d2e8ad36c51d8cce3c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icsys.icn.exe
                    • Path C:\Windows\Resources\Themes\icsys.icn.exe
                    • Size 135KB
                    • SHA256 3819cee0638792b939f811dc02bfcb0f4eb6c52d8d80b907c7fbe6db25f1c440
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SET8FA8.tmp
                    • Path C:\Windows\System32\DriverStore\Temp\{74bdf749-0876-ba43-b674-73b4e4817a5e}\SET8FA8.tmp
                    • Size 169KB
                    • SHA256 753a1386e7b37ee313db908183afe7238f1a2aec5e6c1e59e9c11d471b6aaa8d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SET8FA9.tmp
                    • Path C:\Windows\System32\DriverStore\Temp\{74bdf749-0876-ba43-b674-73b4e4817a5e}\SET8FA9.tmp
                    • Size 12KB
                    • SHA256 52818c67be219bc3b05c58b40e51b99a65c2f4bcafe38a995610b4ec10928def
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SET8FAA.tmp
                    • Path C:\Windows\System32\DriverStore\Temp\{74bdf749-0876-ba43-b674-73b4e4817a5e}\SET8FAA.tmp
                    • Size 2KB
                    • SHA256 a54e0ac05254a464180e30f21a6b26651e7495427353bba9c246ba1d2388e7cc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    spoolsv.exe
                    • Path \??\c:\windows\resources\spoolsv.exe
                    • Size 135KB
                    • SHA256 a0436642d8ccd7e6e61e9fb17bf0b3f3152195260b50192f77f69cfde459b991
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    svchost.exe
                    • Path \??\c:\windows\resources\svchost.exe
                    • Size 135KB
                    • SHA256 82d47c6897cb78919860b52c3a15709504a5f6d41cab52a986252044f6c1ff37
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/1164-507-0x00000000009A0000-0x0000000000A1B000-memory.dmp
                    Download

                    memory/1480-617-0x000002865F3D0000-0x000002865F3DC000-memory.dmp
                    Download

                    memory/1784-511-0x0000000000740000-0x00000000007BB000-memory.dmp
                    Download

                    memory/2572-1045-0x0000000000A00000-0x0000000000A7B000-memory.dmp
                    Download

                    memory/2964-57-0x0000000000540000-0x00000000005BB000-memory.dmp
                    Download

                    memory/2964-1348-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/3460-515-0x0000000000840000-0x00000000008BB000-memory.dmp
                    Download

                    memory/3560-1025-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/3560-1041-0x0000000000480000-0x00000000004FB000-memory.dmp
                    Download

                    memory/3560-1042-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/3644-519-0x00000000010D0000-0x000000000114B000-memory.dmp
                    Download

                    memory/3688-1023-0x0000000000380000-0x00000000003FB000-memory.dmp
                    Download

                    memory/3948-24-0x00000000008C0000-0x000000000093B000-memory.dmp
                    Download

                    memory/4076-1054-0x0000000005E50000-0x0000000005F2B000-memory.dmp
                    Download

                    memory/4076-1053-0x00000000006D0000-0x000000000074B000-memory.dmp
                    Download

                    memory/4224-1000-0x00000000008F0000-0x000000000096B000-memory.dmp
                    Download

                    memory/4256-0-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4256-53-0x00000000008C0000-0x000000000093B000-memory.dmp
                    Download

                    memory/4256-54-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4340-1334-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4340-20-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4340-55-0x0000000000770000-0x00000000007EB000-memory.dmp
                    Download

                    memory/4360-1011-0x0000000001A80000-0x0000000001AFB000-memory.dmp
                    Download

                    memory/4360-1012-0x0000000006480000-0x000000000655B000-memory.dmp
                    Download

                    memory/4360-959-0x0000000001A80000-0x0000000001AFB000-memory.dmp
                    Download

                    memory/4360-960-0x0000000006480000-0x000000000655B000-memory.dmp
                    Download

                    memory/4448-51-0x0000000000590000-0x000000000060B000-memory.dmp
                    Download

                    memory/4448-52-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4536-47-0x0000000000530000-0x00000000005AB000-memory.dmp
                    Download

                    memory/4536-48-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4548-50-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4548-49-0x0000000000530000-0x00000000005AB000-memory.dmp
                    Download

                    memory/4560-1028-0x00000000012D0000-0x000000000134B000-memory.dmp
                    Download

                    memory/4772-997-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/4772-996-0x0000000000580000-0x00000000005FB000-memory.dmp
                    Download

                    memory/4796-498-0x0000000000570000-0x00000000005EB000-memory.dmp
                    Download

                    memory/5040-496-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/5040-23-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/5040-56-0x0000000000790000-0x000000000080B000-memory.dmp
                    Download

                    memory/5040-495-0x0000000000790000-0x000000000080B000-memory.dmp
                    Download

                    memory/5292-499-0x0000000000D60000-0x0000000000DDB000-memory.dmp
                    Download

                    memory/5988-520-0x0000000000E00000-0x0000000000E7B000-memory.dmp
                    Download

                    memory/6000-497-0x0000000001290000-0x000000000130B000-memory.dmp
                    Download