Overview

overview

10

Static

static

3

2026-08-08...yn.exe

windows10-2004-x64

10

2026-08-08...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 18:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe
  • Size 11.9MB
  • Sample260808-wmtekseg76
  • SHA256 0482697f8e14e881e8fa1c72fa9e9ce02ecb1272f5b2ee99dd208f62509df9b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencephishingprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2008
    • \??\c:\users\admin\appdata\local\temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5820
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5536
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1184
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            PID:1920
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5176
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:6048
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:2760
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:500
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5584
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              PID:2100
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:1280
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1348
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              PID:2576
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:2288
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2844
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              6⤵
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3284
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27098 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {a7be3f05-fd92-4b77-b87c-4faba3db900d} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                7⤵
                  PID:5432
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {07e716e9-f6b0-45ed-a2fb-52571dd32a4e} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                  7⤵
                    PID:2780
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 25164 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {412d9e87-422b-46cd-9bf9-55ffe197c323} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                    7⤵
                    • Checks processor information in registry
                    PID:2408
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {9a9970a2-0828-42d8-aaad-13dba861cdab} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                    7⤵
                      PID:2384
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 34773 -prefMapHandle 3036 -prefMapSize 270279 -jsInitHandle 3004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3404 -initialChannelId {6d8b7732-cef8-4fd0-b0be-0ff341777b21} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                      7⤵
                      • Checks processor information in registry
                      PID:120
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3060 -prefsLen 34929 -prefMapHandle 4728 -prefMapSize 270279 -jsInitHandle 4732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4740 -initialChannelId {f59be279-57a5-4f2a-ac00-d8b6019d14ea} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
                      7⤵
                      • Checks processor information in registry
                      PID:5112
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5144 -prefsLen 35010 -prefMapHandle 5148 -prefMapSize 270279 -ipcHandle 5152 -initialChannelId {13b4a36d-122a-4a0b-b396-5a8232170460} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
                      7⤵
                      • Checks processor information in registry
                      PID:1684
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4216 -prefsLen 32952 -prefMapHandle 4228 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3956 -initialChannelId {3c283cbb-e587-491d-9b91-7f626082b5ba} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                      7⤵
                      • Checks processor information in registry
                      PID:5300
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3960 -prefsLen 32952 -prefMapHandle 3944 -prefMapSize 270279 -jsInitHandle 3948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {b63a29aa-b47b-4df4-98cd-2a187b8b9014} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                      7⤵
                      • Checks processor information in registry
                      PID:3208
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 32952 -prefMapHandle 3896 -prefMapSize 270279 -jsInitHandle 3900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3964 -initialChannelId {1904668e-7339-4e54-b0b3-36f6748f8973} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                      7⤵
                      • Checks processor information in registry
                      PID:1480
                • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                  "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4168
                  • C:\Windows\system32\RUNDLL32.EXE
                    "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                    6⤵
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:6032
                    • C:\Windows\system32\runonce.exe
                      "C:\Windows\system32\runonce.exe" -r
                      7⤵
                      • Checks processor information in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2612
                      • C:\Windows\System32\grpconv.exe
                        "C:\Windows\System32\grpconv.exe" -o
                        8⤵
                          PID:4024
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2080
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:4052
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5552
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5096
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2320
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:3356
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:6052
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:4056
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5220
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:3972
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5456
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5856
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2148
                      • C:\Windows\system32\regsvr32.exe
                        /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                        7⤵
                        • Loads dropped DLL
                        PID:1600
                  • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4440
            • C:\Windows\Resources\Themes\icsys.icn.exe
              C:\Windows\Resources\Themes\icsys.icn.exe
              2⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1788
              • \??\c:\windows\resources\themes\explorer.exe
                c:\windows\resources\themes\explorer.exe
                3⤵
                • Modifies visibility of hidden/system files in Explorer
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5092
                • \??\c:\windows\resources\spoolsv.exe
                  c:\windows\resources\spoolsv.exe SE
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4272
                  • \??\c:\windows\resources\svchost.exe
                    c:\windows\resources\svchost.exe
                    5⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2724
                    • \??\c:\windows\resources\spoolsv.exe
                      c:\windows\resources\spoolsv.exe PR
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1040
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ceabfefb-7751-d240-840c-0dbcf97f2dfb}\idmwfp.inf" "9" "4fc2928b3" "000000000000019C" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files (x86)\Internet Download Manager"
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:2172
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000174" "WinSta0\Default"
            1⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:5588
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:3996
            • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
              "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:244
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2440
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4068
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4540
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  3⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:684
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    4⤵
                    • Checks processor information in registry
                    PID:3840
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      5⤵
                        PID:3112
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4284
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4588
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2944
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4348
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5880
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5608
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4876
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2640
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2980
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5632
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2596
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3976
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1376
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      4⤵
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4304
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000013C" "WinSta0\Default"
                1⤵
                • Drops file in Drivers directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:1552

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Browser Extensions

                    1
                    T1176

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Modify Registry

                    4
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    4
                    T1012

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    IDMGetAll.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                    • Size 73KB
                    • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMGetAll64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                    • Size 93KB
                    • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                    • Size 463KB
                    • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                    • Size 656KB
                    • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMNetMon64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                    • Size 522KB
                    • SHA256 8773b407a543e5eb013a683399228372a98e18799785e74a169af16af3116070
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMShellExt64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                    • Size 36KB
                    • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMan.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                    • Size 5.8MB
                    • SHA256 bb749e37c0f1f7725ff5f9ec98bea2735352d0ee973f7854a1c0c66bae5ed991
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MediumILStart.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    • Size 51KB
                    • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                    • Size 197KB
                    • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                    • Size 155KB
                    • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmBroker.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                    • Size 153KB
                    • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmfsa.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                    • Size 90KB
                    • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmftype.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmftype.dll
                    • Size 42KB
                    • SHA256 3a47dbb1f86f2c51f3f8fb9c3a8b1309f5e182ab9af55179959104d262ce985d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmindex.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmindex.dll
                    • Size 427KB
                    • SHA256 1fdb0d5b31e080084c82e0b773dafc7860fa860938b8baef6a4d7f5bde659f73
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmnmcl.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmnmcl.dll
                    • Size 39KB
                    • SHA256 50ca95b9a5cad91a87bfa91fb2ccf0613819437fea2588b116cfae2cc3e5817d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmvs.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                    • Size 20KB
                    • SHA256 a2e28177b51a556742a164955f8b62dcf2bdf848c2f6907fea0c92ee8e4ccddd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ExplorerStartupLog_RunOnce.etl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                    • Size 8KB
                    • SHA256 8a0a114e14676d861c402f6ea19a05cc5e60d8d4bb12ea4ea496818cc304fe9e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Size 16KB
                    • SHA256 495484c5a054ce6316ef5f12f1337b20900833ec817abb431df3de5cb2e682a3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                    • Size 16KB
                    • SHA256 8380cd0fc95f89f93d57e083ec3696eee0c218db6a2867a133f92a5537eede49
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    webext.sc.lz4
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\startupCache\webext.sc.lz4
                    • Size 104KB
                    • SHA256 0956da39d2c36b65e833852befb7ba4d57d17123884ee24e24199fe797452dd6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_386ca55ee31fcd689598356aa0771258_elex_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn.exe 
                    • Size 11.7MB
                    • SHA256 67fb513d0d1fa3e58b4e95dcf8d70e618f4e277474c0e88bc8d1a3e9d0730db1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDM1.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                    • Size 162KB
                    • SHA256 645ee6e64ed04825b25964d992d0205963498bb9d61f5a52be7e76ddb2074003
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 4KB
                    • SHA256 2a15c9016d94450381ce04646eb7407bdcff3f0435ad3d079d1c7308b6ced65b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    s_1.dt
                    • Path C:\Users\Admin\AppData\Roaming\IDM\Scheduler\s_1.dt
                    • Size 316B
                    • SHA256 6d059e9c4670699aaa1b1594917d1be5fe752517d7c7e505f227e8dd181dcebb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    defextmap.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                    • Size 3KB
                    • SHA256 9d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    urlexclist.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                    • Size 3KB
                    • SHA256 9efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 8c2ff7da2ace4b0300652ed1117a77ec2142e3a97feb15a8408ac2d090d4cf6f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 55b6b4521ec28ec9977c0186c280cf70bc6b037026c4d3a8ae0030cd631e779f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 857d35c8bcfebb425d09f48a319eda4d5c9336ef14565be952b1e01fa769ee8a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 0c5732e56b963c495ff1213e404ff3b1ed353f0f564c71f3dd87b39b2607a4a9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    1707a45e-b88d-4b53-90f5-f0d2fd5e5595
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\1707a45e-b88d-4b53-90f5-f0d2fd5e5595
                    • Size 883B
                    • SHA256 48a8bf6e0e935e63c2c5e3e38384d2611279eb2f2d72287c7f1acb5440daca2e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    45990a05-0259-4839-9118-efeb976d0b4f
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\45990a05-0259-4839-9118-efeb976d0b4f
                    • Size 235B
                    • SHA256 ac9b790bf0da7a72f072a42549d22163b5c3334c1f4edf38285c93ab6a84def4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    4944b656-c75c-4fcf-8a81-1f1e481a0898
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\4944b656-c75c-4fcf-8a81-1f1e481a0898
                    • Size 886B
                    • SHA256 35a620ae741189bbb5e756c750029804a0ba5c05fffd44abeefbf2f34eb9cb12
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    c79a409e-5d74-4cf4-bf6f-a5efeae2cf35
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\c79a409e-5d74-4cf4-bf6f-a5efeae2cf35
                    • Size 2KB
                    • SHA256 c0cb9cb55cc64f88f77543e537ac3e24d70ce7955c0cb89a3730158e7d0057c9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    e75a5307-d2b9-42e2-8f9f-bfde82980d6f
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\e75a5307-d2b9-42e2-8f9f-bfde82980d6f
                    • Size 235B
                    • SHA256 bb911072cfaec06f838cd19e867e503d3beea81e5b838aacc93ba90352901152
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    f816c5c6-f91d-4573-882a-89d677e8fc1c
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\f816c5c6-f91d-4573-882a-89d677e8fc1c
                    • Size 15KB
                    • SHA256 d2adad5b1c863526b56e728e211de3e50d468bfa69d7e16eecf2c2aa202c9f6e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\extensions.json
                    • Size 16KB
                    • SHA256 e1f9a208a536190042c83f429c3a98c70bea289968c5a201213a40eceb53342e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
                    • Size 7KB
                    • SHA256 7dae43986a1ee07b71da8d786fbc657347418020a3cda33ed5e26026e59fd27a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 4bd924645f00463cffa5cbf4dad409fade2dfa4a15002de0d33f8029d26c78a1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
                    • Size 6KB
                    • SHA256 23fa6d6129ae6c063066149421033fcdc75756f2c1c35895fede24765f1bf522
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
                    • Size 6KB
                    • SHA256 4db427c7caeb03e1fa220fa9ac5b8d67bebe16cb4448b9c43cf231f928ca6f0f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 065f73bc3b3eace57f9b7778ad375ac8622bf675cc72d189b81ad3b1089d0cd7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    explorer.exe
                    • Path C:\Windows\Resources\Themes\explorer.exe
                    • Size 135KB
                    • SHA256 4d32af452d069a9117f4b6374268eac553a609ac8f9deae3b3b7144309152218
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icsys.icn.exe
                    • Path C:\Windows\Resources\Themes\icsys.icn.exe
                    • Size 135KB
                    • SHA256 20bb52b2e5ec3b762bb5360d858014d22c08eecacd7822a8de9462f65f17866b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    spoolsv.exe
                    • Path C:\Windows\Resources\spoolsv.exe
                    • Size 135KB
                    • SHA256 9343298c3f4cd537a6138e7e2ff21da9dd3dffde2c75566bf99f4167bcf055f5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    svchost.exe
                    • Path C:\Windows\Resources\svchost.exe
                    • Size 135KB
                    • SHA256 621bbf50fcebf57be0d82f8b7e40e9557fcf3b2cb66f01568a124fd31ded10ad
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmwfp.inf_amd64_8b0ebbc2b4585464.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464.ini
                    • Size 415B
                    • SHA256 c8ae0237327b8bee6dfd7b63304858d4b6a115d9dc3d65fc404a2d08b173fdfb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1040-52-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/1788-54-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/1968-18-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/1968-497-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/2008-0-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/2008-22-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/2724-1043-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/2724-46-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4168-931-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/4272-53-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download

                    memory/4540-972-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/5092-977-0x0000000000400000-0x000000000041F000-memory.dmp
                    Download