Overview

overview

8

Static

static

3

Internet D...64.exe

windows11-ltsc_2024-x64

8

_Create in...pt.cmd

windows11-ltsc_2024-x64

8

_Silent Install.cmd

windows11-ltsc_2024-x64

8

_Silent Update.cmd

windows11-ltsc_2024-x64

7

_Silent sc...on.cmd

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    133s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 23:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _Create installation script.cmd
  • Size 1KB
  • Sample260702-3w2kwagx21
  • SHA256 b276580e201b8e46386e0203a5c9ac9ebc6c9b9a68ff8890f78c18e20c9bfa82
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 29 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Create installation script.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:480
    • C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.42.64.exe
      "Internet Download Manager 6.42.64.exe" /SAVEINF="setup.ini"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Users\Admin\AppData\Local\Temp\is-ML8GI.tmp\Internet Download Manager 6.42.64.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-ML8GI.tmp\Internet Download Manager 6.42.64.tmp" /SL5="$401F6,14238184,64512,C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.42.64.exe" /SAVEINF="setup.ini"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2240
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2288
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1932
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\idmfsa.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1472
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
          4⤵
          • Loads dropped DLL
          PID:4540
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:1184
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:852
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4680
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5620
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\idmantypeinfo.tlb"
          4⤵
            PID:4904
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\clean.bat" install"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:6100
            • C:\Windows\SysWOW64\regini.exe
              regini "permdel.txt"
              5⤵
              • Modifies registry class
              PID:4552
            • C:\Windows\SysWOW64\regini.exe
              regini "permdel.txt"
              5⤵
                PID:5156
              • C:\Windows\SysWOW64\regini.exe
                regini "permdel.txt"
                5⤵
                  PID:3420
                • C:\Windows\SysWOW64\regini.exe
                  regini "permdel.txt"
                  5⤵
                    PID:3040
                  • C:\Windows\SysWOW64\regini.exe
                    regini "permdel.txt"
                    5⤵
                    • Modifies registry class
                    PID:3336
                  • C:\Windows\SysWOW64\regini.exe
                    regini "permdel.txt"
                    5⤵
                      PID:3912
                    • C:\Windows\SysWOW64\regini.exe
                      regini "permdel.txt"
                      5⤵
                        PID:2588
                      • C:\Windows\SysWOW64\regini.exe
                        regini "permdel.txt"
                        5⤵
                          PID:3068
                        • C:\Windows\SysWOW64\regini.exe
                          regini "permdel.txt"
                          5⤵
                            PID:5112
                          • C:\Windows\SysWOW64\regini.exe
                            regini "permdel.txt"
                            5⤵
                              PID:3892
                            • C:\Windows\SysWOW64\regini.exe
                              regini "permdel.txt"
                              5⤵
                                PID:1656
                              • C:\Windows\SysWOW64\regini.exe
                                regini "permdel.txt"
                                5⤵
                                  PID:4232
                                • C:\Windows\SysWOW64\regini.exe
                                  regini "permdel.txt"
                                  5⤵
                                    PID:2880
                                  • C:\Windows\SysWOW64\regini.exe
                                    regini "permdel.txt"
                                    5⤵
                                      PID:6136
                                    • C:\Windows\SysWOW64\regini.exe
                                      regini "permdel.txt"
                                      5⤵
                                        PID:4104
                                      • C:\Windows\SysWOW64\regini.exe
                                        regini "permdel.txt"
                                        5⤵
                                          PID:5904
                                        • C:\Windows\SysWOW64\regini.exe
                                          regini "permdel.txt"
                                          5⤵
                                            PID:2436
                                          • C:\Windows\SysWOW64\regini.exe
                                            regini "permdel.txt"
                                            5⤵
                                              PID:1824
                                            • C:\Windows\SysWOW64\regini.exe
                                              regini "permdel.txt"
                                              5⤵
                                                PID:2872
                                              • C:\Windows\SysWOW64\regini.exe
                                                regini "permdel.txt"
                                                5⤵
                                                  PID:3416
                                                • C:\Windows\SysWOW64\regini.exe
                                                  regini "permdel.txt"
                                                  5⤵
                                                    PID:908
                                                  • C:\Windows\SysWOW64\regini.exe
                                                    regini "permdel.txt"
                                                    5⤵
                                                      PID:2088
                                                    • C:\Windows\SysWOW64\regini.exe
                                                      regini "permdel.txt"
                                                      5⤵
                                                        PID:984
                                                      • C:\Windows\SysWOW64\regini.exe
                                                        regini "permdel.txt"
                                                        5⤵
                                                          PID:1876
                                                        • C:\Windows\SysWOW64\regini.exe
                                                          regini "permdel.txt"
                                                          5⤵
                                                          • Modifies registry class
                                                          PID:1528
                                                        • C:\Windows\SysWOW64\regini.exe
                                                          regini "permdel.txt"
                                                          5⤵
                                                            PID:2408
                                                          • C:\Windows\SysWOW64\regini.exe
                                                            regini "permdel.txt"
                                                            5⤵
                                                              PID:2188
                                                            • C:\Windows\SysWOW64\regini.exe
                                                              regini "permdel.txt"
                                                              5⤵
                                                                PID:5988
                                                              • C:\Windows\SysWOW64\regini.exe
                                                                regini "permdel.txt"
                                                                5⤵
                                                                  PID:1684
                                                                • C:\Windows\SysWOW64\regini.exe
                                                                  regini "permdel.txt"
                                                                  5⤵
                                                                    PID:3748
                                                                  • C:\Windows\SysWOW64\regini.exe
                                                                    regini "permdel.txt"
                                                                    5⤵
                                                                      PID:1120
                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                      regini "permdel.txt"
                                                                      5⤵
                                                                        PID:4920
                                                                      • C:\Windows\SysWOW64\regini.exe
                                                                        regini "permdel.txt"
                                                                        5⤵
                                                                          PID:756
                                                                        • C:\Windows\SysWOW64\regini.exe
                                                                          regini "permdel.txt"
                                                                          5⤵
                                                                            PID:252
                                                                          • C:\Windows\SysWOW64\regini.exe
                                                                            regini "permdel.txt"
                                                                            5⤵
                                                                              PID:108
                                                                            • C:\Windows\SysWOW64\regini.exe
                                                                              regini "permdel.txt"
                                                                              5⤵
                                                                                PID:3512
                                                                              • C:\Windows\SysWOW64\regini.exe
                                                                                regini "permdel.txt"
                                                                                5⤵
                                                                                  PID:3272
                                                                                • C:\Windows\SysWOW64\regini.exe
                                                                                  regini "permdel.txt"
                                                                                  5⤵
                                                                                    PID:3720
                                                                                  • C:\Windows\SysWOW64\regini.exe
                                                                                    regini "permdel.txt"
                                                                                    5⤵
                                                                                      PID:1160
                                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                                      regini "permdel.txt"
                                                                                      5⤵
                                                                                        PID:4956
                                                                                      • C:\Windows\SysWOW64\regini.exe
                                                                                        regini "permdel.txt"
                                                                                        5⤵
                                                                                          PID:2576
                                                                                        • C:\Windows\SysWOW64\regini.exe
                                                                                          regini "permdel.txt"
                                                                                          5⤵
                                                                                            PID:5416
                                                                                          • C:\Windows\SysWOW64\regini.exe
                                                                                            regini "permdel.txt"
                                                                                            5⤵
                                                                                              PID:4924
                                                                                            • C:\Windows\SysWOW64\regini.exe
                                                                                              regini "permdel.txt"
                                                                                              5⤵
                                                                                                PID:2532
                                                                                              • C:\Windows\SysWOW64\regini.exe
                                                                                                regini "permdel.txt"
                                                                                                5⤵
                                                                                                • Modifies registry class
                                                                                                PID:4320
                                                                                              • C:\Windows\SysWOW64\regini.exe
                                                                                                regini "permdel.txt"
                                                                                                5⤵
                                                                                                  PID:1116
                                                                                                • C:\Windows\SysWOW64\regini.exe
                                                                                                  regini "permdel.txt"
                                                                                                  5⤵
                                                                                                    PID:2928
                                                                                                  • C:\Windows\SysWOW64\regini.exe
                                                                                                    regini "permdel.txt"
                                                                                                    5⤵
                                                                                                      PID:3196
                                                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                                                      regini "permdel.txt"
                                                                                                      5⤵
                                                                                                        PID:2304
                                                                                                      • C:\Windows\SysWOW64\regini.exe
                                                                                                        regini "permdel.txt"
                                                                                                        5⤵
                                                                                                          PID:4592
                                                                                                        • C:\Windows\SysWOW64\regini.exe
                                                                                                          regini "permdel.txt"
                                                                                                          5⤵
                                                                                                            PID:1444
                                                                                                          • C:\Windows\SysWOW64\regini.exe
                                                                                                            regini "permdel.txt"
                                                                                                            5⤵
                                                                                                              PID:2468
                                                                                                            • C:\Windows\SysWOW64\regini.exe
                                                                                                              regini "permdel.txt"
                                                                                                              5⤵
                                                                                                                PID:1140
                                                                                                              • C:\Windows\SysWOW64\regini.exe
                                                                                                                regini "permdel.txt"
                                                                                                                5⤵
                                                                                                                  PID:4916
                                                                                                                • C:\Windows\SysWOW64\regini.exe
                                                                                                                  regini "permdel.txt"
                                                                                                                  5⤵
                                                                                                                    PID:4972
                                                                                                                  • C:\Windows\SysWOW64\regini.exe
                                                                                                                    regini "permdel.txt"
                                                                                                                    5⤵
                                                                                                                      PID:5176
                                                                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                                                                      regini "permdel.txt"
                                                                                                                      5⤵
                                                                                                                        PID:4800
                                                                                                                      • C:\Windows\SysWOW64\regini.exe
                                                                                                                        regini "permdel.txt"
                                                                                                                        5⤵
                                                                                                                          PID:5788
                                                                                                                        • C:\Windows\SysWOW64\regini.exe
                                                                                                                          regini "permdel.txt"
                                                                                                                          5⤵
                                                                                                                            PID:2924
                                                                                                                          • C:\Windows\SysWOW64\regini.exe
                                                                                                                            regini "permdel.txt"
                                                                                                                            5⤵
                                                                                                                              PID:3876
                                                                                                                            • C:\Windows\SysWOW64\regini.exe
                                                                                                                              regini "permdel.txt"
                                                                                                                              5⤵
                                                                                                                                PID:5948
                                                                                                                              • C:\Windows\SysWOW64\regini.exe
                                                                                                                                regini "permdel.txt"
                                                                                                                                5⤵
                                                                                                                                  PID:1056
                                                                                                                                • C:\Windows\SysWOW64\regini.exe
                                                                                                                                  regini "permdel.txt"
                                                                                                                                  5⤵
                                                                                                                                    PID:4216
                                                                                                                                  • C:\Windows\SysWOW64\regini.exe
                                                                                                                                    regini "permdel.txt"
                                                                                                                                    5⤵
                                                                                                                                      PID:1820
                                                                                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                                                                                      regini "permdel.txt"
                                                                                                                                      5⤵
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:3956
                                                                                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                                                                                      regini "permdel.txt"
                                                                                                                                      5⤵
                                                                                                                                        PID:5392
                                                                                                                                      • C:\Windows\SysWOW64\regini.exe
                                                                                                                                        regini "permdel.txt"
                                                                                                                                        5⤵
                                                                                                                                          PID:3284
                                                                                                                                        • C:\Windows\SysWOW64\regini.exe
                                                                                                                                          regini "permdel.txt"
                                                                                                                                          5⤵
                                                                                                                                            PID:2384
                                                                                                                                          • C:\Windows\SysWOW64\regini.exe
                                                                                                                                            regini "permdel.txt"
                                                                                                                                            5⤵
                                                                                                                                              PID:4832
                                                                                                                                            • C:\Windows\SysWOW64\regini.exe
                                                                                                                                              regini "permdel.txt"
                                                                                                                                              5⤵
                                                                                                                                                PID:5628
                                                                                                                                              • C:\Windows\SysWOW64\regini.exe
                                                                                                                                                regini "permdel.txt"
                                                                                                                                                5⤵
                                                                                                                                                  PID:1636
                                                                                                                                                • C:\Windows\SysWOW64\regini.exe
                                                                                                                                                  regini "permdel.txt"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:528
                                                                                                                                                  • C:\Windows\SysWOW64\regini.exe
                                                                                                                                                    regini "permdel.txt"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5064
                                                                                                                                                    • C:\Windows\SysWOW64\regini.exe
                                                                                                                                                      regini "permdel.txt"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:2960
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F
                                                                                                                                                        5⤵
                                                                                                                                                          PID:1832
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F
                                                                                                                                                          5⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4796
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F
                                                                                                                                                          5⤵
                                                                                                                                                            PID:3696
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F
                                                                                                                                                            5⤵
                                                                                                                                                              PID:3828
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F
                                                                                                                                                              5⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4468
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F
                                                                                                                                                              5⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2132
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F
                                                                                                                                                              5⤵
                                                                                                                                                                PID:5260
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5928
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F
                                                                                                                                                                  5⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2392
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F
                                                                                                                                                                  5⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1892
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:2976
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:5632
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5348
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2012
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F
                                                                                                                                                                          5⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4512
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F
                                                                                                                                                                          5⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5008
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5616
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F
                                                                                                                                                                            5⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1724
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg delete "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5768
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg delete "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:5136
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg delete "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:4736
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg delete "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1164
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg delete "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1324
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg delete "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5572
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg delete "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1352
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg delete "HKLM\Software\Classes\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2300
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg delete "HKLM\Software\Classes\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3036
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg delete "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5516
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg delete "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:5452
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg delete "HKLM\Software\Classes\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3780
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg delete "HKLM\Software\Classes\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:5356
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg delete "HKLM\Software\Classes\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:5912
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg delete "HKLM\Software\Classes\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:5940
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg delete "HKLM\Software\Classes\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1052
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg delete "HKLM\Software\Classes\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:1136
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg delete "HKLM\Software\Classes\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKLM\SOFTWARE\Internet Download Manager" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4144
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2264
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2704
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3448
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:5196
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5980
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5840
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3724
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:828
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg delete "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3988
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg delete "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:716
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg delete "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg delete "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg delete "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5740
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg delete "HKCU\Software\Classes\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5188
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg delete "HKCU\Software\Classes\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg delete "HKCU\Software\Classes\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg delete "HKCU\Software\Classes\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg delete "HKCU\Software\Classes\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg delete "HKCU\Software\Classes\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg delete "HKCU\Software\Classes\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1316
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg delete "HKCU\Software\DownloadManager" /v "FName" /F
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg delete "HKCU\Software\DownloadManager" /v "LName" /F
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:704
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /v "Email" /F
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2004
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /v "Serial" /F
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /v "scansk" /F
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1824
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /v "tvfrdt" /F
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg delete "HKCU\Software\DownloadManager" /v "radxcnt" /F
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:3576
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /v "LstCheck" /F
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2908
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /v "ptrk_scdt" /F
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /v "LastCheckQU" /F
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /v "CheckUpdtVM" /F
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                              "C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files (x86)\Internet Download Manager\IDMShellExt.dll"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                              • C:\Windows\system32\RUNDLL32.EXE
                                                                                                                                                                                                                                "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                • C:\Windows\system32\runonce.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\runonce.exe" -r
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                  PID:2452
                                                                                                                                                                                                                                  • C:\Windows\System32\grpconv.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\grpconv.exe" -o
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:3512
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                      C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                        C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2020
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:776
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                        C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5352
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                        C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                          C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                            C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:720
                                                                                                                                                                                                                                            • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                              PID:788
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          "taskkill" /f /im IDMan.exe
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regedit.exe
                                                                                                                                                                                                                                          "C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\idmreg.reg"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Runs .reg file with regedit
                                                                                                                                                                                                                                          PID:1216
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regedit.exe
                                                                                                                                                                                                                                          "C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Runs .reg file with regedit
                                                                                                                                                                                                                                          PID:3920
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:1164
                                                                                                                                                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {212387e0-a291-4c3c-b399-0252e6716880} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {e2289b4a-d45e-42f0-a593-f75edb40c9ad} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:3008
                                                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25213 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {b2991088-8adf-417d-9497-a30b8f38d6a6} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4136 -prefsLen 27323 -prefMapHandle 4140 -prefMapSize 270279 -ipcHandle 4232 -initialChannelId {3a6fb06e-f97e-4ed0-b5ec-37d64e5ed4bf} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 34822 -prefMapHandle 3320 -prefMapSize 270279 -jsInitHandle 3324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {f8994a9d-f545-463a-ac22-d4f29bd99a38} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3464 -prefsLen 35010 -prefMapHandle 3472 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {b70ada81-7013-48b7-929e-384025cff9ce} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32900 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {6fecab01-8f24-4ffd-bc41-2ed866063868} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:6024
                                                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32900 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {1616dd44-4001-4f18-947e-31a93fd00985} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:3580
                                                                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {12825ca0-99ce-4f5f-a45f-50a85404ede9} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:2920
                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {da3d7fb7-d119-4312-9c94-bcf28aac2ce8} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:2316
                                                                                                                                                                                                                                                                  • C:\Windows\system32\RUNDLL32.EXE
                                                                                                                                                                                                                                                                    "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                    • C:\Windows\system32\runonce.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\runonce.exe" -r
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                      PID:1576
                                                                                                                                                                                                                                                                      • C:\Windows\System32\grpconv.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\grpconv.exe" -o
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:1488
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:1116
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:5800
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                        PID:2660
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:756
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:3032
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\net.exe" start IDMWFP
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:5712
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:2200
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:1476
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:824
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:2892
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                          /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:3876
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:1528
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:2932
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                                  /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                    PID:2752
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:3696
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                                                                                                                                                      /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lrepacks.net/
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:2088
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x394,0x7ffcfe15c188,0x7ffcfe15c194,0x7ffcfe15c1a0
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:2168
                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,11428192232129818655,2849420086322422149,262144 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,11946453193930879943,8095184729860841675,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:11
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • System Time Discovery
                                                                                                                                                                                                                                                                                                                            PID:1060
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,3021966755433338479,14894395837673621454,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,18369086073142486749,6741319916266783808,2097152 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,1198430638581788512,3068318608979728323,2097152 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,4316956102025800934,7876869455081707344,2097152 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:3644
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,6222291436963089096,17369969970965959809,2097152 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:944
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,18064771372063051842,8054775042133598574,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2788377279722404998,9826190200857460772,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:5796
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,9615113388117016869,16648820909010025156,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3519485477737024470,18153612046349145246,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:1460
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5940,i,16809586828951306555,10574357136426358922,2097152 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:4284
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,10902543014109360043,1011112763928226189,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1116
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,5677968265695994839,9381255468685881801,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1600
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,1781017010713621396,8797020242259041357,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,1781017010713621396,8797020242259041357,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,8468228184292620159,10798878546990848496,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,3641362874779958615,9595001288366823977,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,8969241103972602981,6272864956539298246,524288 --field-trial-handle=2240,i,273206304764571068,6558103921721682612,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2c13da32-992c-eb4e-923b-05613a4a65a5}\idmwfp.inf" "9" "4fc2928b3" "000000000000017C" "WinSta0\Default" "000000000000018C" "208" "C:\Program Files (x86)\Internet Download Manager"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                      DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000018C" "WinSta0\Default"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\grpconv.exe
                                                                                                                                                                                                                                                                                                                                                      grpconv -o
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6104
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                        DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000170" "WinSta0\Default"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3012

                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                  Browser Extensions

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1176

                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1546.015

                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1546.015

                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                                                  System Time Discovery

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1124

                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                  IDMGetAll.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 73KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  IDMGetAll64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 93KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  IDMIECC.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 463KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  IDMIECC64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 656KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  IDMNetMon64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 555KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c08ff1c6ffa6242f693ffe98dad40425a0770e78e774265e5038117a8fcd54a4
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  IDMShellExt64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 36KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  IDMan.exe
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                                                                                                                                                                                                                                                                                                                  • Size 5.8MB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9c47c8597cf99e58406ffc09378079ba1755bf8f29d69f08a838b0ae52756374
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-09728.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\BITMAP\is-09728.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d75cb499868df1ce6d3f256ac47b45771a2d0d6c6619328c409ad56b9d9e0205
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-49GKE.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\BITMAP\is-49GKE.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a4074e72a20dec596c7b2fac2cc9627b6e63791338b91ab2498edc8b7734b27e
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-7EIFL.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\BITMAP\is-7EIFL.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3632362bec45e376123658a94b535e545a854c27832c6e6f88df964a86f2e725
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-K9HT5.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\BITMAP\is-K9HT5.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d738939b930117bb322e5b528fe41c1267104ef0334880be7acd14a9bbc9b29a
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-P0TQ6.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Dtu_Style\BITMAP\is-P0TQ6.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 678B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ebf6c327ada56a4cb4a69120c51f053ab06e8a210860888e5d9584e74a518e46
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-05IN0.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Bronze_Shapes_Toolbar\is-05IN0.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 110KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d6026c1fb28dacea812c4beb1851d432612de954d9ee67d1f3bd591dc644edbf
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-2M2LT.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\H3M_Bronze_Shapes_Toolbar\is-2M2LT.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 63KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4eb8ff2ada51737686c65f83857b60403e2f8f7e7e3bbc0bc23ff38754474e60
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-1L25F.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Helvet_3D_Light\is-1L25F.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 110KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 46a1a0cac18c5369b69c12f6739c4ad7f3c07a693b164c489a65b7b394a1b328
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-7N4CB.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Helvet_3D_Light\is-7N4CB.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 56KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3f6f6b0f19fff7251f539e75dab0e39163af65280d43a7d8d241a3348ed04809
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-JJ9NC.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Helvet_3D_Light\is-JJ9NC.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 110KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4a54c62e75b0c3d124655204d1e189cff1f12baeeebb4a9942bcd1b7b416210c
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-QMG56.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Helvet_3D_Light\is-QMG56.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 56KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 76d7cb8059b4c9fb5948e8d428fd9571214f399986b4cd3a3ae9bdf32c77638d
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-QVSTB.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Helvet_3D_Light\is-QVSTB.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 110KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9b7a789c5f088cd1c17d1b5110abb82830818fe9c15b89643d6dcde3e3267e63
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-498GK.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\PT LIGHT\is-498GK.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 110KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4a6880a580b1eda105ea70b2b815855ec6507c3419ff8a90d893c10bf563652b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-D0SOG.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013\BITMAP\is-D0SOG.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ebd59efbf6e29b8f66192c49eb66d456d1e70e994f7be21372edf14b41b5804b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-FEI3I.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013\BITMAP\is-FEI3I.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 20c3bfea40854a4ff0017b6857a9df967e5387c391bf293f5bd745f4c5b5167b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-G698A.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013\BITMAP\is-G698A.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b18e40529e5428531c6243072e4f735087e419c02b7a4f95dea87d7a96b87be1
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-GNQ73.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013\BITMAP\is-GNQ73.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0d5c2d3336e80011aede7fcb2418ad4fd4b86379d9fe777325d301beebadd4b4
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  is-KUVCS.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\Toolbar\Pure_Flat_2013\BITMAP\is-KUVCS.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f9c14db70fece40ff7afa6d313342e589402f0d2cb8edd1e763514947d5deea7
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  downlWithIDM.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 197KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  downlWithIDM64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 155KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  idmantypeinfo.tlb
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\idmantypeinfo.tlb
                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d421d11ef7cf2b766ca6fbc8e837912b2100339c686d48ca56f650649f7b9343
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  idmfsa.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 90KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                                  • Size 6B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                                  • Size 70KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  CURRENT
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
                                                                                                                                                                                                                                                                                                                                                                  • Size 16B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 14ba70cd93cd08259e415a6cd18ddc4298314844c0346ea59bc79515e908be7b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                  • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8f84906933b1248ef74f85d7619798a226a5da1927143a49f2d41fe072423056
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                  • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e878c7dba6d58ce23b851068d1579a054c7c6180a159ebc9f1396e6074442f62
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  webext.sc.lz4
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gbpv12ht.default-release\startupCache\webext.sc.lz4
                                                                                                                                                                                                                                                                                                                                                                  • Size 105KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0163dda0a8dedca2d1ef200c1c15512f396e47edd0e249f1c1c3bfbd38efec49
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  ff2d40ab-5576-4e90-90cb-0e2f509abf6d.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ff2d40ab-5576-4e90-90cb-0e2f509abf6d.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 1B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  ISTask.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\ISTask.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 66KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  VclStylesInno.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\VclStylesInno.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  clean.bat
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\clean.bat
                                                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f23ca0bb966bc045eff08e5c18c124d17560802c5e3fbd01f95d5801c9f01dda
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 981064fb62e24895752e48fbfb34743c4067e6c62b4bdc428a81a15c60931c34
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8b52d569c6890ca059af3c52e8d429fe1fde3daa863442b52bd4285b32e21d16
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2c98593d3a5996239dffd2871abb4c917973ce8c58917e151bc325fc5814e8e8
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 849a8c5d827f0affa97c0d2bd03004fa6ebf13f093f9bf40c65ee7ea1cdd4cba
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 03a8814526deb1f3bcb7d30a8e4a3281629c248fa648ff7994a2fa3f795c3be4
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 be612790b8a20f236f6ae2b0eccff6ca40c372b4fff07d7cb74abcb1ebb33fb0
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fc312eb9a166cc33265535013cf667b34ed3802913990d1284dd0232603ff939
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2f1e1d5585bdaf5b72a6c89f8bab7ae2c5d8eec6fa5375e61470b5ff27169877
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 50755d3bf0e93ef709b2f442bf109b8b9f2904bc0d306d6ab501b3b86c5477e2
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9eaffc0476a5851b7af1e66f65e75ef45e4f1f08d11e13165e6deea3a25ca590
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 12c9004fb10709eecdf946f6696adeaf8f5e9f29c4f75d1ad262e28acc54f056
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5d781aa7c993adfac3d167beed6423876a5fa2fd7747df0e47ab6d942750711d
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1d36d56957a1feee4976e2d8fb09060693bb53be1471fe6954c928d6b835baac
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 bc142c296ef5f0995b0e405185d14996ff92ed8e18547000ffee891119809d23
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 85e462cabd99de621faa4f111cf33c9559c110511d17307dfb8af68dd7049009
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dcb5957adf5351c747286488dca09fbf2418c4002e1527d3aab622b9c728a96b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 42652c51018b9aba18d65d38821a137f7f42f286c6d547238d8ad81de1e4b043
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 87B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 219fb695c27000c289efb20277d37534e560b3cc87c475223bb707eabe1b2b68
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 18571d1dccad4ea0ea2c6bb9c2bb7d376e92ac19df32a9b0f63032ef98cf0580
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1be47b4a7508928c9079054985752b1891e835c6dc2ebe453d05d82d95902d1e
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6e654a55102c29b4ac61d4482b28a03e57206675e25850a68a0b7bd94a215af9
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 765d39516932b0cfc57b7a3fb6c5cf57718999008a99b0608f8ce4dc2de0d16b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b6bfba427a97f037d4e31fabac70b19361b9b1d8005d4be9f037a95c1f6ac180
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 02d22562137c78c4f567dccc33ed93b69e528de241d1fb58f6a651877bfe1a50
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 79ebba395cb9643e387fc21c689287dd344e654e18ca08045714ebb189509f54
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 47d213993654aeddda8e19a089288743ad3e9f0d1be4b52ae0873941097fe763
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 325f0ba8c48f4aafb773bd7a38614e9520d157d4b3ef0816838ba5ca4a740469
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9f805f84417f2415ca890adc182d7f15c57793ab598b26f3f8268cb1362e70aa
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 836a4a27c5a9cc6365bec8c64bc8ecf85bbbaa2b9419bf3643758e20b0654040
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e8f5f149889c9ee7a57be83cdce91149e0ee4bbc65508aad2738ef597fa1d424
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 23885a9fc8de32831f74677f729b92b3c8acf51ba522ae9c1c39cbc727d47a30
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e2d03403a65b14727ce45f9ebeae9786d972f3a06f94e6cfc28a78c80f7a832f
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 abde7edc373f9132748270662bd44ff737bca6042c1d8d5c6e4d82d6e103b719
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5930ba7d8a5dbf99ea385a556357bd26800a3598ad2b70c00a699dd28baf36d4
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-7TMSU.tmp\permdel.txt
                                                                                                                                                                                                                                                                                                                                                                  • Size 75B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 56ebe7f8652e4ed60673bb6a13a53fb663710f96502f49ab3820cd5b1c1d1499
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  Internet Download Manager 6.42.64.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-ML8GI.tmp\Internet Download Manager 6.42.64.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 911KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 109e48992f332ddde3f2ff8ea6459f11eff3d7968dab4951dc96ed7507f1bbf6
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  content.js
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2088_1765606616\CRX_INSTALL\content.js
                                                                                                                                                                                                                                                                                                                                                                  • Size 26KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 db85c3b72249f7e74b8c1687a76d50ede39c2d93252ffead3a92e262a3fbcb97
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  content_new.js
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2088_2147103320\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                                                                                                                                                                  • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  setup.ini
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\setup.ini
                                                                                                                                                                                                                                                                                                                                                                  • Size 153B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 704bd7ca4a6257c3fa455a252c21905e91c9d7de39cb6b3d418d0e47223610a3
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  idmcchandler2.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 326KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1450146b904919474ef6d528b20a672a33a32afc4a1e40f69d515b523d72fa19
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  idmcchandler2_64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll
                                                                                                                                                                                                                                                                                                                                                                  • Size 451KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 59ac02f5a0644bf56b7ad7e2b48fc8f89083f8cfe12a0a93f63163a5573a876f
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 14a4cf6981ee747fb2bb515e919b0718fb0c35821bad5807d7b52b265981f2c4
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a313be15e47164a7ed04bf29056272f19b6d0f30375b11f94ad96635f4fb88fd
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 273554d3cb47fad69c336859e5da9a4f57db1de0247b2435ab81a79783dc36ca
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 830fe09d3dd827b0b923b02358ff22d4bc7854c6fbc8c209210d294570c68e0a
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  events
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c66f0d119c8d39bfaf76806e5a81d79df762c0a0b0af8015045aa3ee4c08d0b9
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  0b2b3aab-ae32-4a5d-b8d5-37b313ebeb12
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\pending_pings\0b2b3aab-ae32-4a5d-b8d5-37b313ebeb12
                                                                                                                                                                                                                                                                                                                                                                  • Size 235B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 16109b7191720249693a96ce9efb1818c44066abc03c921fddd95f669798420b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  26697d1e-c5ee-42b7-a6c5-2ed04e989fd8
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\pending_pings\26697d1e-c5ee-42b7-a6c5-2ed04e989fd8
                                                                                                                                                                                                                                                                                                                                                                  • Size 871B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 847693209394d24107aee7bb25e8dd6a244ab0ec25b8e7eef7bcb9afc714b8aa
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  52fffd1b-0819-413b-a34c-5a8bb508a2c5
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\pending_pings\52fffd1b-0819-413b-a34c-5a8bb508a2c5
                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2b07604a34be56784b75e6ae5ed11d21bad835d4413b5141b9e1287c0527da75
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  a9d543f6-49fa-4a40-8b62-b2cb2ddbaf22
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\pending_pings\a9d543f6-49fa-4a40-8b62-b2cb2ddbaf22
                                                                                                                                                                                                                                                                                                                                                                  • Size 235B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 daa54e4ee6459a2d1a08aa1d409a5a063733f34a1caf86b2615147aac86eaedf
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  c92ec1e1-81d2-47a6-8805-3ff4d7be2b16
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\pending_pings\c92ec1e1-81d2-47a6-8805-3ff4d7be2b16
                                                                                                                                                                                                                                                                                                                                                                  • Size 886B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d7cd1e55b8eb89c631c4a14d12f681c90c2d2131a8bd5acc8d7f661f32e6ab7a
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  cd299659-214a-439a-ba4c-1197077d8844
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\datareporting\glean\pending_pings\cd299659-214a-439a-ba4c-1197077d8844
                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 98eb42e04685d8ae76397d5502b0ed4b4126d574a2427a0672187a53718c6222
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5ef585dfa7e246144ed5e259596ec8c9664c5f29fc15330d1379368e5eb0238b
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 86b2f5cf8306deb45925e7860fcde3c55076cf20592e88a8ce2357ca8234c12d
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  prefs.js
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3a93d036b31f997c3af2315263eaceb74cded223a131675253eb1de9e6454ac5
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  sessionCheckpoints.json.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                                                                                                                                                                  • Size 288B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  idmwfp.inf_amd64_8b0ebbc2b4585464.ini
                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464.ini
                                                                                                                                                                                                                                                                                                                                                                  • Size 415B
                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c1a2d03e47971e4abd86aa46590c0d94ef6583e32a073fa4e1b446bd3524efda
                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2316-1630-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2592-0-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2592-97-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-29-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-48-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-42-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-55-0x0000000008300000-0x0000000008301000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-61-0x0000000008320000-0x0000000008321000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-64-0x0000000008330000-0x0000000008331000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-73-0x0000000008360000-0x0000000008361000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-78-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-50-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-51-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-82-0x0000000008390000-0x0000000008391000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-53-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-54-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-56-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-59-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-57-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-60-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-62-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-63-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-65-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-66-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-68-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-69-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-71-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-72-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-74-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-75-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-87-0x0000000007F9E000-0x0000000007F9F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-77-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-81-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-83-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-39-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-38-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-52-0x00000000082F0000-0x00000000082F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-32-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-49-0x00000000082E0000-0x00000000082E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-30-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-91-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-27-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-41-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-92-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-76-0x0000000008370000-0x0000000008371000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-1188-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-93-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-84-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-47-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-70-0x0000000008350000-0x0000000008351000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-67-0x0000000008340000-0x0000000008341000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-45-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-58-0x0000000008310000-0x0000000008311000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-44-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-36-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-35-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-33-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-31-0x0000000008280000-0x0000000008281000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-28-0x0000000008270000-0x0000000008271000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-25-0x0000000008260000-0x0000000008261000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-88-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-89-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-90-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-80-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-395-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-102-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-101-0x0000000002400000-0x0000000002401000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-79-0x0000000008380000-0x0000000008381000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-26-0x0000000008120000-0x0000000008260000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-34-0x0000000008290000-0x0000000008291000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-37-0x00000000082A0000-0x00000000082A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-94-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-40-0x00000000082B0000-0x00000000082B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-43-0x00000000082C0000-0x00000000082C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-46-0x00000000082D0000-0x00000000082D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-23-0x0000000007E00000-0x000000000811A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-17-0x0000000002520000-0x0000000002536000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2620-6-0x0000000002400000-0x0000000002401000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2964-1192-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                  memory/2964-1176-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                  Download