Overview

overview

10

Static

static

3

2026-08-08...yn.exe

windows10-2004-x64

10

2026-08-08...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 18:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe
  • Size 11.9MB
  • Sample260808-wmtekseg76
  • SHA256 0482697f8e14e881e8fa1c72fa9e9ce02ecb1272f5b2ee99dd208f62509df9b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencephishingprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4888
    • \??\c:\users\admin\appdata\local\temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1548
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1912
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            PID:1116
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:728
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3476
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:1360
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:1952
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2328
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4008
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:3560
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1872
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:2972
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1068
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              PID:5036
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3152
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:312
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4180
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              6⤵
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3020
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {54e309a3-a276-41ae-bef1-5b185ef89649} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                7⤵
                  PID:1064
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2516 -prefsLen 27135 -prefMapHandle 2520 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {89a1c514-feab-446a-81a0-047f326b6b60} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                  7⤵
                    PID:4752
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 25164 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {ab7fe808-83b4-4461-89db-75ff54ea2858} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                    7⤵
                    • Checks processor information in registry
                    PID:2440
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27276 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {ecda1e71-d164-4027-82aa-1e34e4f84d45} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                    7⤵
                      PID:3880
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 34775 -prefMapHandle 1400 -prefMapSize 270279 -jsInitHandle 1372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2776 -initialChannelId {cf27bfce-81d4-44dd-b25b-017e74e6394a} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                      7⤵
                      • Checks processor information in registry
                      PID:4792
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 34931 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {ec7d6044-7320-4028-8587-81301659e8eb} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
                      7⤵
                      • Checks processor information in registry
                      PID:4376
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2652 -prefsLen 35012 -prefMapHandle 4552 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {48f60919-bf60-4861-b774-8af5bffd3a08} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
                      7⤵
                      • Checks processor information in registry
                      PID:5808
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {0d9ae884-b8b9-4b6c-bc4a-4099eb0c0f07} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                      7⤵
                      • Checks processor information in registry
                      PID:6072
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {928c73d1-fd0b-429b-bf5c-0499344d5f64} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                      7⤵
                      • Checks processor information in registry
                      PID:6080
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32952 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {9a97ff35-36eb-4ed2-959d-3c0673c68665} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                      7⤵
                      • Checks processor information in registry
                      PID:6092
                • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                  "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                  5⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4416
                  • C:\Windows\system32\RUNDLL32.EXE
                    "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                    6⤵
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4060
                    • C:\Windows\system32\runonce.exe
                      "C:\Windows\system32\runonce.exe" -r
                      7⤵
                      • Checks processor information in registry
                      • Suspicious use of WriteProcessMemory
                      PID:996
                      • C:\Windows\System32\grpconv.exe
                        "C:\Windows\System32\grpconv.exe" -o
                        8⤵
                          PID:4288
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3764
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:2052
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5728
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:2300
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5600
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5468
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5336
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5284
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5232
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5180
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5852
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:6064
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:5940
                      • C:\Windows\system32\regsvr32.exe
                        /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                        7⤵
                        • Loads dropped DLL
                        PID:5924
                  • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:6112
            • C:\Windows\Resources\Themes\icsys.icn.exe
              C:\Windows\Resources\Themes\icsys.icn.exe
              2⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4584
              • \??\c:\windows\resources\themes\explorer.exe
                c:\windows\resources\themes\explorer.exe
                3⤵
                • Modifies visibility of hidden/system files in Explorer
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5048
                • \??\c:\windows\resources\spoolsv.exe
                  c:\windows\resources\spoolsv.exe SE
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5016
                  • \??\c:\windows\resources\svchost.exe
                    c:\windows\resources\svchost.exe
                    5⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3116
                    • \??\c:\windows\resources\spoolsv.exe
                      c:\windows\resources\spoolsv.exe PR
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:5072
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2592
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e6fd617b-4230-0d4e-ab34-281c3cc64953}\idmwfp.inf" "9" "4fc2928b3" "0000000000000148" "WinSta0\Default" "000000000000014C" "208" "C:\Program Files (x86)\Internet Download Manager"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:624
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000014C" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:4400
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000164" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:3796
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:1792
            • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
              "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:2404
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2908
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5512
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5504
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  3⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5520
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    4⤵
                    • Checks processor information in registry
                    PID:5472
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      5⤵
                        PID:5404
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:924
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4304
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5652
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5960
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4172
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      4⤵
                        PID:624
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2276
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5056
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:5004
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4960
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2196
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5516
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:5448
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:3972
                      • C:\Windows\system32\regsvr32.exe
                        /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                        4⤵
                        • Loads dropped DLL
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5344

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Browser Extensions

                      1
                      T1176

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Modify Registry

                      4
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      5
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      IDMGetAll.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                      • Size 73KB
                      • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMGetAll64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                      • Size 93KB
                      • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMIECC.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                      • Size 463KB
                      • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMIECC64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                      • Size 656KB
                      • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMNetMon64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                      • Size 522KB
                      • SHA256 8773b407a543e5eb013a683399228372a98e18799785e74a169af16af3116070
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMShellExt64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                      • Size 36KB
                      • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMan.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                      • Size 5.8MB
                      • SHA256 bb749e37c0f1f7725ff5f9ec98bea2735352d0ee973f7854a1c0c66bae5ed991
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MediumILStart.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                      • Size 51KB
                      • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      downlWithIDM.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                      • Size 197KB
                      • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      downlWithIDM64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                      • Size 155KB
                      • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmBroker.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                      • Size 153KB
                      • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmfsa.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                      • Size 90KB
                      • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmnmcl.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\idmnmcl.dll
                      • Size 39KB
                      • SHA256 50ca95b9a5cad91a87bfa91fb2ccf0613819437fea2588b116cfae2cc3e5817d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmvs.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                      • Size 20KB
                      • SHA256 a2e28177b51a556742a164955f8b62dcf2bdf848c2f6907fea0c92ee8e4ccddd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ExplorerStartupLog_RunOnce.etl
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                      • Size 8KB
                      • SHA256 5bfdf3e2d03ad61855cbd80c4958957a26a5af4e478b9809fc467d298caac5ad
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                      • Size 16KB
                      • SHA256 e3b5f6c27eb0b43b27f40d0ae2f34e867ef9a3b911139eea304507a21e1aaa02
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                      • Size 16KB
                      • SHA256 69db01ef4b0372de032a6ca734ef0ecb52f73a0499e34c46cc4c4171e37ee2a7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      webext.sc.lz4
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\startupCache\webext.sc.lz4
                      • Size 104KB
                      • SHA256 61420d3db53413102371278eb71aea881dd211349d0a9b8bc55bbdeb25dd7a95
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
                      • Size 11.7MB
                      • SHA256 67fb513d0d1fa3e58b4e95dcf8d70e618f4e277474c0e88bc8d1a3e9d0730db1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDM1.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                      • Size 162KB
                      • SHA256 645ee6e64ed04825b25964d992d0205963498bb9d61f5a52be7e76ddb2074003
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMSetup2.log
                      • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                      • Size 4KB
                      • SHA256 2a15c9016d94450381ce04646eb7407bdcff3f0435ad3d079d1c7308b6ced65b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 11KB
                      • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 502KB
                      • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmwfp64.sys
                      • Path C:\Users\Admin\AppData\Local\Temp\{E6FD6~1\idmwfp64.sys
                      • Size 169KB
                      • SHA256 753a1386e7b37ee313db908183afe7238f1a2aec5e6c1e59e9c11d471b6aaa8d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmwfp.inf
                      • Path C:\Users\Admin\AppData\Local\Temp\{e6fd617b-4230-0d4e-ab34-281c3cc64953}\idmwfp.inf
                      • Size 2KB
                      • SHA256 a54e0ac05254a464180e30f21a6b26651e7495427353bba9c246ba1d2388e7cc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      defextmap.dat
                      • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                      • Size 3KB
                      • SHA256 9d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      urlexclist.dat
                      • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                      • Size 3KB
                      • SHA256 9efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 6KB
                      • SHA256 ed258dce31b3d5553342d67c4b61486375346ba51d4bdad51543dc78e187b309
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 7KB
                      • SHA256 68ff6023cc45119e07bc32520b6575e510f3d12c93990aefecaafc3ff52b2f78
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 7KB
                      • SHA256 884b5b2823b08c80296713a0479226ff86581eb5c97166cdafc7f2083a1793d3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      events
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
                      • Size 1KB
                      • SHA256 cf19dc07facaaf2d2656d18514e9062d98a0743daab2d60a237e619dc380bf4c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      1cbd6d93-3ba6-4bdf-b000-d9eca2efc02f
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\1cbd6d93-3ba6-4bdf-b000-d9eca2efc02f
                      • Size 883B
                      • SHA256 56c65a8243968cd22dc2fd1571a63913298f405d938962aae42e9f94c93cca80
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      7b5b1926-7bd0-4ecf-8e25-f1c3077a42ac
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\7b5b1926-7bd0-4ecf-8e25-f1c3077a42ac
                      • Size 2KB
                      • SHA256 bdd66e7f28efebf790d9755aabcf286c165d449f2143dd617f49e7d7cbb97dfe
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      8276339f-47fa-471e-835e-7bbded00e596
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\8276339f-47fa-471e-835e-7bbded00e596
                      • Size 15KB
                      • SHA256 9f3123bba6ff6b190bf309c93d2e274e43bb83e95c0b58632faf2b05f6cd7b21
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e1b4e701-23b0-4220-9aeb-77df69696816
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\e1b4e701-23b0-4220-9aeb-77df69696816
                      • Size 235B
                      • SHA256 5c5d5d3ada144d317a82c92b53f8e2f4fea20cea0aff439d3455893162b4ebea
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e3842a0e-bcfc-49de-9f7a-212277088d76
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\e3842a0e-bcfc-49de-9f7a-212277088d76
                      • Size 886B
                      • SHA256 cea9091a066d094f9b1565f510a2c34414ac1ee22355fd3c06076880b0d56736
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e68263d2-d81f-4bda-90cf-742ef34fa710
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\e68263d2-d81f-4bda-90cf-742ef34fa710
                      • Size 235B
                      • SHA256 bc4d9a4f604b2c76fd9af74df45901f5e10c03ff5a7b394990a56a9bba64a998
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      extensions.json
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
                      • Size 16KB
                      • SHA256 847ff17ad5897ca198c2231db58e7033b267bb57fdaa4f36400e02903a121f35
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gmpopenh264.dll
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                      • Size 1.1MB
                      • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gmpopenh264.info
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                      • Size 116B
                      • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      manifest.json
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                      • Size 1002B
                      • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      widevinecdm.dll
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                      • Size 21.6MB
                      • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs-1.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
                      • Size 8KB
                      • SHA256 c87d2b957c04b58a04f7725aed5329f6430b153b1b61daac63f1660373adc2a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs-1.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
                      • Size 6KB
                      • SHA256 35532371fb115955ca1b23a85323b9364825cb6fcf95b33e5992c91e518223c5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
                      • Size 7KB
                      • SHA256 449cfa8cc4c76f756ce4b4fce8fb847d8ade85da9f5a12da723a8a1351d20ca3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
                      • Size 6KB
                      • SHA256 f509fb5d2d613e26a1b8222f2e72a4f5b27b149b25a6e952bc9222b7997217c8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      recovery.baklz4
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
                      • Size 4KB
                      • SHA256 40e239481a74d3e80a2946028bff9cf3a6372d9a41f93ebbf50d26fc0ef32f54
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      3870112724rsegmnoittet-es.sqlite
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                      • Size 4.2MB
                      • SHA256 48dedcfc69d1dcfa4bc8d410469b71b680acd7561d285567a8fb4499c9c05402
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icsys.icn.exe
                      • Path C:\Windows\Resources\Themes\icsys.icn.exe
                      • Size 135KB
                      • SHA256 20bb52b2e5ec3b762bb5360d858014d22c08eecacd7822a8de9462f65f17866b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      spoolsv.exe
                      • Path C:\Windows\Resources\spoolsv.exe
                      • Size 135KB
                      • SHA256 8ce2ed760a06f48a813e70896139fce9506ef75b68470e68272705bc3f10142b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      svchost.exe
                      • Path C:\Windows\Resources\svchost.exe
                      • Size 135KB
                      • SHA256 3f3e1f9da187f7b8b3eafc58c04a5c60543edfded8f9abf8fb9300757940a943
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SETF019.tmp
                      • Path C:\Windows\System32\DriverStore\Temp\{a9e54d2c-0341-f04c-86be-95a02430b93c}\SETF019.tmp
                      • Size 12KB
                      • SHA256 52818c67be219bc3b05c58b40e51b99a65c2f4bcafe38a995610b4ec10928def
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      explorer.exe
                      • Path \??\c:\windows\resources\themes\explorer.exe
                      • Size 135KB
                      • SHA256 7086cbb3fa9d3ae0706b366a74aa3927de58f9879a9ba3055781ac295b743387
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1548-22-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/1548-481-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/3116-1140-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/4416-530-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/4584-12-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/4584-48-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/4888-0-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/4888-49-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/5016-47-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/5048-1030-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/5072-46-0x0000000000400000-0x000000000041F000-memory.dmp
                      Download

                      memory/5504-1017-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download