Analysis
- max time kernel
149s - max time network
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 03:41
General
- Target 2026-06-29_c7e56b88a910c7331880411a3c3932b8_elex_wannacry.exe
- Size 8.7MB
- Sample260630-d813faev3p
- SHA256 3437298867e06e62485f7ef4d76e8a3534ecc492e143bc7b067e3dbe30c0d036
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 23 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in Program Files directory 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 46 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_c7e56b88a910c7331880411a3c3932b8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_c7e56b88a910c7331880411a3c3932b8_elex_wannacry.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ( powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Warning;$NotifyIcon.BalloonTipTitle = 'Internet Download Manager 6.43 Build 2'; $NotifyIcon.BalloonTipText = 'Program Yükleniyor !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()" )2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Warning;$NotifyIcon.BalloonTipTitle = 'Internet Download Manager 6.43 Build 2'; $NotifyIcon.BalloonTipText = 'Program Yükleniyor !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c for %i in (IDM1.tmp IDMan.exe IEMonitor.exe) do taskkill /f /im "%i" /t2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "IDM1.tmp" /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "IDMan.exe" /t3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "IEMonitor.exe" /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if not exist "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" ( if exist "C:\Program Files (x86)\Internet Download Manager" rd /s /q "C:\Program Files (x86)\Internet Download Manager" )2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Local\Internet Download Manager" rd /s /q "C:\Users\Admin\AppData\Local\Internet Download Manager" )2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\Internet Download Manager" rd /s /q "C:\Users\Admin\AppData\Roaming\Internet Download Manager" )2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\ProgramData\Internet Download Manager" rd /s /q "C:\ProgramData\Internet Download Manager" )2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /wait "app" Setup\IDM1.tmp -d "C:\ProgramData\IDM\Setup\" -skdlgs2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\IDM\Setup\IDM1.tmpSetup\IDM1.tmp -d "C:\ProgramData\IDM\Setup\" -skdlgs3⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr /onsilentsetup4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c for %i in (IDM1.tmp IDMan.exe IEMonitor.exe) do taskkill /f /im "%i" /t2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "IDM1.tmp" /t3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "IDMan.exe" /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "IEMonitor.exe" /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" ( "C:\ProgramData\IDM\Cleaner.bat" )2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c whoami /user /fo list3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whoami.exewhoami /user /fo list4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\reg.exereg query HKU\S-1-5-193⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exereg query "HKU\.DEFAULT\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "LastCheckQU" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "CheckUpdtVM" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "scansk" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "radxcnt" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "ptrk_scdt" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "Model" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "Therad" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "MData" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKCU\Software\DownloadManager" /v "tvfrdt" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "TipStartUp" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "bShLc2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LstCheck" /t REG_SZ /d "12/31/99" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LanguageID" /t REG_DWORD /d "31" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "ronaldinho424" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " / www.tnctr.com" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "Email" /t REG_SZ /d "[email protected]" /f3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" ( if exist "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Information;$NotifyIcon.BalloonTipTitle = 'Internet Download Manager 6.43 Build 2'; $NotifyIcon.BalloonTipText = 'Kurulum Tamamlandı !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()" ) else ( if exist "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Error;$NotifyIcon.BalloonTipTitle = 'Internet Download Manager 6.43 Build 2'; $NotifyIcon.BalloonTipText = 'Kurulum Tamamlanamadı !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()" )2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Add-Type -AssemblyName System.Windows.Forms;$NotifyIcon = New-Object System.Windows.Forms.NotifyIcon;$NotifyIcon.Icon = [System.Drawing.SystemIcons]::Information;$NotifyIcon.BalloonTipTitle = 'Internet Download Manager 6.43 Build 2'; $NotifyIcon.BalloonTipText = 'Kurulum Tamamlandı !';$NotifyIcon.Visible = $true; $NotifyIcon.ShowBalloonTip(5000); Start-Sleep -Seconds 5; $NotifyIcon.Dispose()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
IDM0.tmp
IDM1.tmp
IDM10.tmp
IDM100.tmp
IDM101.tmp
IDM102.tmp
IDM103.tmp
IDM104.tmp
IDM105.tmp
IDM106.tmp
IDM107.tmp
IDM108.tmp
IDM109.tmp
IDM11.tmp
IDM110.tmp
IDM111.tmp
IDM112.tmp
IDM113.tmp
IDM114.tmp
IDM115.tmp
IDM116.tmp
IDM117.tmp
IDM118.tmp
IDM119.tmp
IDM12.tmp
IDM120.tmp
IDM121.tmp
IDM122.tmp
IDM123.tmp
IDM124.tmp
IDM125.tmp
IDM126.tmp
IDM127.tmp
IDM128.tmp
IDM129.tmp
IDM13.tmp
IDM130.tmp
IDM131.tmp
IDM132.tmp
IDM133.tmp
IDM134.tmp
IDM135.tmp
IDM136.tmp
IDM137.tmp
IDM138.tmp
IDM139.tmp
IDM14.tmp
IDM140.tmp
IDM141.tmp
IDM142.tmp
IDM143.tmp
IDM144.tmp
IDM145.tmp
IDM146.tmp
IDM147.tmp
IDM148.tmp
IDM149.tmp
IDM15.tmp
IDM150.tmp
IDM151.tmp
IDM152.tmp
IDM153.tmp
IDM154.tmp
IDMSetup2.log
IDMSetup2.log
prep_Activatable Class_Hermes_perf.cache
memory/1280-908-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1280-409-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1436-403-0x00000000734B2000-0x00000000734B3000-memory.dmp
memory/1436-387-0x0000000002860000-0x0000000002896000-memory.dmp
memory/1436-386-0x00000000734B2000-0x00000000734B3000-memory.dmp
memory/1436-404-0x00000000734A0000-0x0000000073C5C000-memory.dmp
memory/1436-406-0x00000000734A0000-0x0000000073C5C000-memory.dmp
memory/1436-402-0x00000000070E0000-0x0000000007172000-memory.dmp
memory/1436-396-0x0000000005880000-0x0000000005BDB000-memory.dmp
memory/1436-393-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/1436-392-0x0000000005670000-0x00000000056D6000-memory.dmp
memory/1436-391-0x0000000004F70000-0x0000000004F92000-memory.dmp
memory/1436-390-0x00000000734A0000-0x0000000073C5C000-memory.dmp
memory/1436-388-0x00000000734A0000-0x0000000073C5C000-memory.dmp
memory/1436-389-0x0000000005020000-0x000000000566A000-memory.dmp
memory/1436-397-0x0000000005C40000-0x0000000005C5E000-memory.dmp
memory/1436-401-0x00000000081B0000-0x000000000876A000-memory.dmp
memory/1436-400-0x0000000006180000-0x000000000619A000-memory.dmp
memory/1436-399-0x0000000007570000-0x0000000007BEC000-memory.dmp
memory/1436-398-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/2416-988-0x0000014494790000-0x00000144947B0000-memory.dmp
memory/2416-974-0x0000014484390000-0x00000144843B0000-memory.dmp
memory/2416-958-0x0000014494410000-0x0000014494510000-memory.dmp
memory/2416-943-0x00000144801E0000-0x00000144802E0000-memory.dmp
memory/2416-957-0x0000014482FB0000-0x0000014482FD0000-memory.dmp
memory/5056-937-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5328-1127-0x000001515A770000-0x000001515ABA4000-memory.dmp