Analysis
- user interaction
yes - max time kernel
59s - max time network
89s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 14:04
General
- Target IDM_6.4x_Crack_v20.6.exe
- Size 66KB
- Sample260809-rdcm9astht
- SHA256 bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 25 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Drops Chrome extension 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 16 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 16 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 46 IoCs
- Modifies data under HKEY_USERS 43 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 3 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 45 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe"C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_yog12bp.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://internetdownloadmanager.com/2⤵
- Drops Chrome extension
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa085ac728,0x7ffa085ac734,0x7ffa085ac7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,6323426695587934090,9176850462758533800,262144 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,6059263163742019527,8730212038884255011,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,14429056592388605929,10740512893951648703,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,13329144846686357238,14029733550942965026,2097152 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,12182514373772637347,2539816152836694765,2097152 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,17049274274409000911,6369091626694176430,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,6859506065768998232,11669288949257620518,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5164 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,6396868303784629765,15597764622889446762,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\idman643build8.exe"C:\Users\Admin\Downloads\idman643build8.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"7⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"7⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"7⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html7⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2108 -initialChannelId {5f29068c-2921-4d39-9555-03d163b4c0f5} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2492 -prefsLen 27135 -prefMapHandle 2496 -prefMapSize 270279 -ipcHandle 2504 -initialChannelId {42f0267e-5bb4-4719-89a5-dec8c4046445} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 25164 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {8dfe55d0-6762-4136-bbb8-f4d16a47ca28} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27276 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {c361f8a1-292d-4ff1-ade9-c8f775efd160} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360 -prefsLen 34829 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4376 -initialChannelId {f0507418-7dd3-4bef-8308-68a1e5288f90} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1276 -prefsLen 35012 -prefMapHandle 2984 -prefMapSize 270279 -jsInitHandle 2796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3404 -initialChannelId {c45be898-b776-4952-bc40-84525bdc9877} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35012 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 5128 -initialChannelId {fa192945-5666-412a-8558-a2d1cb367ad0} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5276 -prefsLen 32900 -prefMapHandle 5280 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {3fab70fe-8e55-44b3-bfc4-fed915b02fef} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32900 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {b9fc8d0e-b631-4f1d-ad3e-34492ff91835} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 32900 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {ed8b572e-9e17-43ce-9598-57714fe41866} -parentPid 2212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab8⤵
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf7⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r8⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o9⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP7⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP8⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"8⤵
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"6⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,15864162758757353827,13242156515750679125,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,16807512916157976642,11531383956433262099,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,10352396164181594021,21803436431438854,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5812,i,3439717846911927225,14062381599966036035,2097152 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5968,i,3900444416214788730,15415438449523078994,2097152 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,17630128452563504192,15527687999390572053,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6196 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,12680331507072143142,14244383853836912665,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,8521978079540714984,11414968114715131998,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5164,i,5180567220898260351,18299193033592543273,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,1618492967720581209,14806404303533940976,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,9928541950681349223,18263876725752682566,524288 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6256,i,18219964932349939282,17423252961831451606,2097152 --field-trial-handle=1976,i,14167012179063286541,11233260314663854633,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:23⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.da282c6d28b82ea7 > \\.\pipe\chrome.nativeMessaging.out.da282c6d28b82ea73⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=04⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.5716b76ebc64eee6 > \\.\pipe\chrome.nativeMessaging.out.5716b76ebc64eee63⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=04⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.efa655531c0c1f30 > \\.\pipe\chrome.nativeMessaging.out.efa655531c0c1f303⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=04⤵
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\reg.exereg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd3⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "3⤵
-
-
C:\Windows\system32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\find.exefind /i "FullLanguage"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"3⤵
-
-
C:\Windows\system32\find.exefind /i "computersystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"4⤵
-
-
-
C:\Windows\system32\reg.exereg query HKU\\Software3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"4⤵
-
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-889581200-2041691093-2048517887-1000\Software3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-889581200-2041691093-2048517887-1000\IAS_TEST /f3⤵
-
-
C:\Windows\system32\reg.exereg add HKCU\IAS_TEST3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-889581200-2041691093-2048517887-1000\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-889581200-2041691093-2048517887-1000\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-889581200-2041691093-2048517887-1000\Software\DownloadManager" /v ExePath 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-889581200-2041691093-2048517887-1000\Software\DownloadManager" /v ExePath4⤵
-
-
-
C:\Windows\system32\reg.exereg add HKU\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"4⤵
-
-
-
C:\Windows\system32\reg.exereg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20260809-150539485.reg"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$sid = 'S-1-5-21-889581200-2041691093-2048517887-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b6f59378-54bb-5646-9f9e-e1bfc2d05cdd}\idmwfp.inf" "9" "4fc2928b3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Internet Download Manager"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000168" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000148" "WinSta0\Default"2⤵
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
-
-
-
C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe"C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe" -runcm2⤵
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
IDMGetAll.dll
IDMGetAll64.dll
IDMIECC.dll
IDMIECC64.dll
IDMMsgHost.exe
IDMNetMon64.dll
IDMShellExt64.dll
IDMan.exe
downlWithIDM.dll
downlWithIDM64.dll
idmBroker.exe
idmfsa.dll
idmvs.dll
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
captured.html
captured.js
content.js
debug.js
document.js
headBkgd.gif
headTitle.gif
logo128.png
logo16.png
logo16x.png
logo32.png
logo32x.png
logo48.png
logoTonec.gif
welcome.html
welcome.js
messages.json
craw_background.js
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
data_1
data_0
data_2
data_3
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
webext.sc.lz4
CRK_UPDT_yog12bp.vbs
IDM1.tmp
IDMSetup2.log
REG9418.tmp
WININF.vbs
__PSScriptPolicyTest_yixqy0e5.ek3.ps1
background.js
manifest.json
3688d237-4a70-4c99-89b1-04f8ea5058e4.tmp
messages.json
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
451eec47-0d46-4544-a984-f32fc9f13c5f
5f4ff0ad-dd9a-4f37-9a26-b7bc6c77a8c6
86ce211e-0713-4ce2-9fee-6ff07a59e2fa
adb7e1a2-328e-4534-962e-89cd03c608e4
ba23ff2e-4e89-4651-ae9f-2ecd40787664
d7bb392d-2694-42a9-8153-28047d80c6db
fb63f4aa-56fe-4390-abae-cd50c92ed4df
prefs-1.js
prefs.js
prefs.js
sessionCheckpoints.json
Unconfirmed 23332.crdownload
SET54BD.tmp
SET54BE.tmp
SET54BF.tmp
memory/2664-873-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2664-153-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3420-1865-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-8-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-1436-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-83-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-1946-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-0-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-9-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-409-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-853-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3420-126-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4540-1351-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6424-1939-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6424-1866-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6856-1868-0x000002B17DA50000-0x000002B17DA72000-memory.dmp